{ "type": "bundle", "spec_version": "2.1", "id": "bundle--fcd2c4c4-187d-4da7-9368-73b4bcc472ca", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "objects": [ { "type": "malware", "spec_version": "2.1", "id": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Cyclops Blink", "description": "Cyclops Blink is a malicious Linux ELF executable, compiled for the 32-bit PowerPC (big-endian) architecture. NCSC, FBI, CISA, NSA and industry analysis has associated it with a large-scale botnet targeting Small Office/Home Office (SOHO) network devices. This botnet has been active since at least June 2019, affecting WatchGuard Firebox and possibly other SOHO network devices.", "malware_types": [ "remote-access-trojan" ], "is_family": false, "capabilities": [ "captures-system-state-data", "communicates-with-c2", "degrades-system-updates", "exfiltrates-data", "installs-other-components", "persists-after-system-reboot", "fingerprints-host" ], "architecture_execution_envs": [ "powerpc" ], "implementation_languages": [ "c" ], "x_operating_systems": [ "linux" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c63a5841-2c14-43dd-9bf6-7e2b35dd80aa", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Command and Scripting Interpreter: Unix Shell as used by Cyclops Blink", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ], "description": "Cyclops Blink executes downloaded files using the Linux API function execlp." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--07cab05d-5a1e-4b90-b749-bdce5e0deb3e", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--c63a5841-2c14-43dd-9bf6-7e2b35dd80aa", "target_ref": "attack-pattern--a9d4b653-6915-42af-98b2-5758c4ceee56" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d8744a52-30e6-4327-949e-0631b1be8407", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566", "target_ref": "attack-pattern--c63a5841-2c14-43dd-9bf6-7e2b35dd80aa" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--df25da3d-9849-49b8-bfa9-f54504150e02", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Boot or Logon Initialization Scripts: RC Scripts as used by Cyclops Blink", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ], "description": "Cyclops Blink is executed on device start-up, using a modified S51armled RC script." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--62e69a2d-1511-427e-a90e-3aab83eb3fa9", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--df25da3d-9849-49b8-bfa9-f54504150e02", "target_ref": "attack-pattern--dca670cf-eeec-438f-8185-fd959d9ef211" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9482db78-b333-4972-ab6e-1c0319289557", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566", "target_ref": "attack-pattern--df25da3d-9849-49b8-bfa9-f54504150e02" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ca7eeeee-5902-4f54-b8ac-6ddfd51a8787", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Pre-OS Boot: System Firmware as used by Cyclops Blink", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ], "description": "Cyclops Blink maintains persistence throughout the legitimate device firmware update process. This is achieved by patching the firmware when it is downloaded to the device." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4cafdce8-bf30-484c-adb7-128d131ddb4a", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--ca7eeeee-5902-4f54-b8ac-6ddfd51a8787", "target_ref": "attack-pattern--16ab6452-c3c1-497c-a47d-206018ca1ada" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e1e27e5f-3659-4772-84ce-3d40a7ff2a2a", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566", "target_ref": "attack-pattern--ca7eeeee-5902-4f54-b8ac-6ddfd51a8787" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e6a965ea-f4f6-4acb-8b28-ec9cea9dae32", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "System Information Discovery as used by Cyclops Blink", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ], "description": "Cyclops Blink regularly queries device information." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--91d832a0-6ad4-48e8-9cff-3e3af39484b5", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--e6a965ea-f4f6-4acb-8b28-ec9cea9dae32", "target_ref": "attack-pattern--354a7f88-63fb-41b5-a801-ce3b377b36f1" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--157fb8d7-7086-4ad6-9aea-c251c8415cab", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566", "target_ref": "attack-pattern--e6a965ea-f4f6-4acb-8b28-ec9cea9dae32" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--116cce2d-a609-4054-a041-44dc848e2008", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Data Encoding: Non-Standard Encoding as used by Cyclops Blink", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "description": "Cyclops Blink command messages use a custom binary scheme to encode the specific command to be executed, as well as any command parameters required." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b8669cf6-df5f-4a92-ae45-00a28c284d97", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--116cce2d-a609-4054-a041-44dc848e2008", "target_ref": "attack-pattern--d467bc38-284b-4a00-96ac-125f447799fc" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e0a85f64-2066-4575-b1ea-2a02a9930630", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566", "target_ref": "attack-pattern--116cce2d-a609-4054-a041-44dc848e2008" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Fallback Channels as used by Cyclops Blink", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "description": "Cyclops Blink randomly selects a C2 server from contained lists of IPv4 addresses and port numbers." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--56a7b44b-b2ae-48e6-b823-db6adda73d83", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d", "target_ref": "attack-pattern--f24faf46-3b26-4dbb-98f2-63460498e433" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b9aa5571-177b-4fcf-98c2-ce15fb9ca26c", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--87f87492-7659-47e7-b18d-e956b656cbcd", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Application Layer Protocol: Web Protocols as used by Cyclops Blink", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "description": "Cyclops Blink can download files via HTTP or HTTPS." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e333fe29-0488-4309-a005-035879f3a408", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--87f87492-7659-47e7-b18d-e956b656cbcd", "target_ref": "attack-pattern--df8b2a25-8bdf-4856-953c-a04372b1c161" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--63143d60-ecbe-4d5b-b181-70f714f60866", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566", "target_ref": "attack-pattern--87f87492-7659-47e7-b18d-e956b656cbcd" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--00d46220-650f-446e-888c-28c5b6e7246a", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Encrypted Channel: Asymmetric Cryptography as used by Cyclops Blink", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "description": "Cyclops Blink C2 messages are individually encrypted using AES-256-CBC and sent underneath TLS. OpenSSL library functions are used to encrypt each message using a randomly generated key and IV, which are then encrypted using a hard-coded RSA public key." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ae3751f1-82fb-4f19-80d0-c0fa6f2c5a2e", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--00d46220-650f-446e-888c-28c5b6e7246a", "target_ref": "attack-pattern--bf176076-b789-408e-8cba-7275e81c0ada" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e7a63adf-19ad-44dd-b8f2-c9340e99f9d8", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566", "target_ref": "attack-pattern--00d46220-650f-446e-888c-28c5b6e7246a" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6b6a60ce-8252-415c-a41f-0e9498b1eb21", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Non-Standard Port as used by Cyclops Blink", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "description": "Cyclops Blink contains a list of port numbers used for C2 communication. This list includes non-standard ports not typically associated with HTTP or HTTPS traffic." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7b16d653-1af0-4723-9153-84346f76fef5", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--6b6a60ce-8252-415c-a41f-0e9498b1eb21", "target_ref": "attack-pattern--b18eae87-b469-4e14-b454-b171b416bc18" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--20c06da1-9e4a-4a94-b7f7-94291f3e1786", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566", "target_ref": "attack-pattern--6b6a60ce-8252-415c-a41f-0e9498b1eb21" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--bb7fb086-2db0-4109-ae4f-b66b7981cd94", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Exfiltration Over C2 Channel as used by Cyclops Blink", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "exfiltration" } ], "description": "Cyclops Blink is capable of uploading files to a C2 server." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0458d1c5-906e-4790-a3d3-cf755decd591", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--bb7fb086-2db0-4109-ae4f-b66b7981cd94", "target_ref": "attack-pattern--92d7da27-2d91-488e-a00c-059dc162766d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--04ef95e1-8127-4de9-8352-780aa64b8c7e", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566", "target_ref": "attack-pattern--bb7fb086-2db0-4109-ae4f-b66b7981cd94" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--722e1b6f-7f55-4582-b334-447990149568", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Impair Defenses: Disable or Modify System Firewall as used by Cyclops Blink", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "Cyclops Blink modifies the Linux iptables firewall to enable C2 communication via a stored list of port numbers." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--16353b26-4a77-42d6-8fd5-c227edfd6999", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--722e1b6f-7f55-4582-b334-447990149568", "target_ref": "attack-pattern--5372c5fe-f424-4def-bcd5-d3a8e770f07b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--57491d05-794b-4da7-880f-74391a0a5c2f", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566", "target_ref": "attack-pattern--722e1b6f-7f55-4582-b334-447990149568" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--19ac6aac-7739-4a02-a153-f458527138a1", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Masquerading: Match Legitimate Name or Location as used by Cyclops Blink", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "description": "Cyclops Blink renames its running process to masquerade as a Linux kernel thread." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--608a9331-945f-472d-b82f-dfcd9e300022", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--19ac6aac-7739-4a02-a153-f458527138a1", "target_ref": "attack-pattern--1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f3c7c7a5-81c0-49c3-bc1d-896fde73921f", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566", "target_ref": "attack-pattern--19ac6aac-7739-4a02-a153-f458527138a1" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--687174a5-1921-4483-8e1e-99c024d34fe5", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617", "target_ref": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--63c8e6c1-d6cc-4a19-a594-1cc8b0917912", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617", "target_ref": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--73c0cc79-7aa6-48d9-a736-491f2a7d389d", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49", "target_ref": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c19da6d8-2735-40ee-a451-02c864830476", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49", "target_ref": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a0a0b9bb-a1a4-4f05-8203-b3d9e363e19e", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59", "target_ref": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7c8f84be-c115-4d83-854e-f3e04d406dcd", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59", "target_ref": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--398c7f61-b6d8-497a-9ce2-3a0980f7824a", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ce56ef7b-a93c-4b26-a073-f5346799332e", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--46d21346-9302-4e49-856b-3e38d614a1c4", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a5053201-d73a-4372-83c0-31cc95b3170e", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fca6d808-31c4-49ef-8fc4-4b8dfbcf940b", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--c7489ade-b373-465f-896f-43431c725090", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4dbcb6d5-1691-4c14-9518-aa7abd6d4cdf", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--c7489ade-b373-465f-896f-43431c725090", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7d6f935a-dc3f-4cf2-b7c1-e6fe23ef4acc", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--4a7e6b04-409b-48b7-b60b-117700278e90", "target_ref": "indicator--fd1ccbde-2620-41e7-b066-6b9960de3698" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--46962eba-bf01-4bc3-9aba-7be842549a88", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--4a7e6b04-409b-48b7-b60b-117700278e90", "target_ref": "indicator--0e9cea64-ac6e-42d3-81e3-2120d79e9813" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6e87f0ee-6551-4d76-a09e-1b55841ee192", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--fd1ccbde-2620-41e7-b066-6b9960de3698", "target_ref": "indicator--4a7e6b04-409b-48b7-b60b-117700278e90" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c7df7c18-2315-451c-8f3a-ecc019ebb24c", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--fd1ccbde-2620-41e7-b066-6b9960de3698", "target_ref": "indicator--0e9cea64-ac6e-42d3-81e3-2120d79e9813" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a4d8197d-63e3-4dcf-8f5c-30c5f42964f0", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--0e9cea64-ac6e-42d3-81e3-2120d79e9813", "target_ref": "indicator--4a7e6b04-409b-48b7-b60b-117700278e90" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--83815d8f-094d-4a80-83c2-c847b2998aa5", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--0e9cea64-ac6e-42d3-81e3-2120d79e9813", "target_ref": "indicator--fd1ccbde-2620-41e7-b066-6b9960de3698" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c47a6612-ccd5-42d9-86ba-2dc7d51e18b4", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--c2f04d4c-e200-4153-8700-febf15d36c5e", "target_ref": "indicator--8e88a48f-cadf-443b-8994-fc321dbffefd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1bc83535-cd81-4ca1-a3a7-cc5400b09dc2", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--c2f04d4c-e200-4153-8700-febf15d36c5e", "target_ref": "indicator--a0d92396-35e9-4500-99c8-27f128239684" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--70de279d-8638-4c5c-b861-7a8f81e6e53f", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--8e88a48f-cadf-443b-8994-fc321dbffefd", "target_ref": "indicator--c2f04d4c-e200-4153-8700-febf15d36c5e" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9397b364-9c7d-4de2-8c56-1c575a1bd1c5", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--8e88a48f-cadf-443b-8994-fc321dbffefd", "target_ref": "indicator--a0d92396-35e9-4500-99c8-27f128239684" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6bdf477f-5b8d-4e44-910e-64e6e9a21721", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--a0d92396-35e9-4500-99c8-27f128239684", "target_ref": "indicator--c2f04d4c-e200-4153-8700-febf15d36c5e" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c810ce19-34a4-43d1-b275-50074aa6406b", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--a0d92396-35e9-4500-99c8-27f128239684", "target_ref": "indicator--8e88a48f-cadf-443b-8994-fc321dbffefd" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = 'd01e2c2e8df92edeb8298c55211bc4b6']", "description": "Cyclops Blink - Linux ELF PowerPC big-endian. File name - cpd.", "valid_from": "2022-02-21T13:30:15.289Z", "name": "Cyclops Blink sample (MD5: d01e2c2e8df92edeb8298c55211bc4b6)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--96333f43-c1ce-4405-b79f-163019aa5f6d", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = '3adf9a59743bc5d8399f67cab5eb2daf28b9b863']", "description": "Cyclops Blink - Linux ELF PowerPC big-endian. File name - cpd.", "valid_from": "2022-02-21T13:30:15.289Z", "name": "Cyclops Blink sample (SHA-1: 3adf9a59743bc5d8399f67cab5eb2daf28b9b863)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d17dbaf7-9d21-4817-88d7-32fc5f694813", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = '50df5734dd0c6c5983c21278f119527f9fdf6ef1d7e808a29754ebc5253e9a86']", "description": "Cyclops Blink - Linux ELF PowerPC big-endian. File name - cpd.", "valid_from": "2022-02-21T13:30:15.289Z", "name": "Cyclops Blink sample (SHA-256: 50df5734dd0c6c5983c21278f119527f9fdf6ef1d7e808a29754ebc5253e9a86)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5c10646c-8667-4ccb-adf4-9e77077814bb", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = 'bbb76de7654337fb6c2e851d106cebc7']", "description": "Cyclops Blink - Linux ELF PowerPC big-endian. File name - cpd.", "valid_from": "2022-02-21T13:30:15.290Z", "name": "Cyclops Blink sample (MD5: bbb76de7654337fb6c2e851d106cebc7)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fd56ed7a-b6b4-4a40-8e6e-a48d2b3136ca", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = 'c59bc17659daca1b1ce65b6af077f86a648ad8a8']", "description": "Cyclops Blink - Linux ELF PowerPC big-endian. File name - cpd.", "valid_from": "2022-02-21T13:30:15.290Z", "name": "Cyclops Blink sample (SHA-1: c59bc17659daca1b1ce65b6af077f86a648ad8a8)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--00bc634d-df62-4cbb-9a9f-38eaa05099e3", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c7489ade-b373-465f-896f-43431c725090", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = 'c082a9117294fa4880d75a2625cf80f63c8bb159b54a7151553969541ac35862']", "description": "Cyclops Blink - Linux ELF PowerPC big-endian. File name - cpd.", "valid_from": "2022-02-21T13:30:15.290Z", "name": "Cyclops Blink sample (SHA-256: c082a9117294fa4880d75a2625cf80f63c8bb159b54a7151553969541ac35862)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1ab506d6-0d95-4ce4-b411-1e1996e16a02", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--c7489ade-b373-465f-896f-43431c725090", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4a7e6b04-409b-48b7-b60b-117700278e90", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = '3c9d46dc4e664e20f1a7256e14a33766']", "description": "Cyclops Blink embedded ELF - Linux ELF PowerPC big-endian. File name - install_upgrade.", "valid_from": "2022-02-21T13:30:15.291Z", "name": "Cyclops Blink sample (MD5: 3c9d46dc4e664e20f1a7256e14a33766)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f93deb56-52c6-4349-ab4f-77348574270a", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--4a7e6b04-409b-48b7-b60b-117700278e90", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fd1ccbde-2620-41e7-b066-6b9960de3698", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = '7d61c0dd0cd901221a9dff9df09bb90810754f10']", "description": "Cyclops Blink embedded ELF - Linux ELF PowerPC big-endian. File name - install_upgrade.", "valid_from": "2022-02-21T13:30:15.291Z", "name": "Cyclops Blink sample (SHA-1: 7d61c0dd0cd901221a9dff9df09bb90810754f10)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a3e3412e-c4dc-40ce-aa41-93721bf5d35c", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--fd1ccbde-2620-41e7-b066-6b9960de3698", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0e9cea64-ac6e-42d3-81e3-2120d79e9813", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = '4e69bbb61329ace36fbe62f9fb6ca49c37e2e5a5293545c44d155641934e39d1']", "description": "Cyclops Blink embedded ELF - Linux ELF PowerPC big-endian. File name - install_upgrade.", "valid_from": "2022-02-21T13:30:15.291Z", "name": "Cyclops Blink sample (SHA-256: 4e69bbb61329ace36fbe62f9fb6ca49c37e2e5a5293545c44d155641934e39d1)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c0b7e4b0-3760-40cf-99ab-34f4cfce7c15", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--0e9cea64-ac6e-42d3-81e3-2120d79e9813", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c2f04d4c-e200-4153-8700-febf15d36c5e", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = '3f22c0aeb1eec4350868368ea1cc798c']", "description": "Cyclops Blink embedded ELF - Linux ELF PowerPC big-endian. File name - install_upgrade.", "valid_from": "2022-02-21T13:30:15.292Z", "name": "Cyclops Blink sample (MD5: 3f22c0aeb1eec4350868368ea1cc798c)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9c6c347f-5f68-4c0d-b58c-bebd0024d193", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--c2f04d4c-e200-4153-8700-febf15d36c5e", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8e88a48f-cadf-443b-8994-fc321dbffefd", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = '438cd40caca70cafe5ca436b36ef7d3a6321e858']", "description": "Cyclops Blink embedded ELF - Linux ELF PowerPC big-endian. File name - install_upgrade.", "valid_from": "2022-02-21T13:30:15.292Z", "name": "Cyclops Blink sample (SHA-1: 438cd40caca70cafe5ca436b36ef7d3a6321e858)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1fb96d54-1d83-4abc-b607-c259a656fd4e", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--8e88a48f-cadf-443b-8994-fc321dbffefd", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a0d92396-35e9-4500-99c8-27f128239684", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = 'ff17ccd8c96059461710711fcc8372cfea5f0f9eb566ceb6ab709ea871190dc6']", "description": "Cyclops Blink embedded ELF - Linux ELF PowerPC big-endian. File name - install_upgrade.", "valid_from": "2022-02-21T13:30:15.292Z", "name": "Cyclops Blink sample (SHA-256: ff17ccd8c96059461710711fcc8372cfea5f0f9eb566ceb6ab709ea871190dc6)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9b74b52a-7441-4a57-af62-dae9931e6b99", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--a0d92396-35e9-4500-99c8-27f128239684", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1f377bb7-de3f-4153-af8d-d278f5d604aa", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule CyclopsBlink_notable_strings\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects notable strings identified within the Cyclops Blink executable\"\r\n date = \"2022-02-23\"\r\n hash1 = \"3adf9a59743bc5d8399f67cab5eb2daf28b9b863\"\r\n hash2 = \"c59bc17659daca1b1ce65b6af077f86a648ad8a8\"\r\n\r\n strings:\r\n // Process names masqueraded by implant\r\n $proc_name1 = \"[kworker/0:1]\"\r\n $proc_name2 = \"[kworker/1:1]\"\r\n // DNS query over SSL, used to resolve C2 server address\r\n $dns_query = \"POST /dns-query HTTP/1.1\\x0d\\x0aHost: dns.google\\x0d\\x0a\"\r\n // iptables commands\r\n $iptables1 = \"iptables -I %s -p tcp --dport %d -j ACCEPT &>/dev/null\"\r\n $iptables2 = \"iptables -D %s -p tcp --dport %d -j ACCEPT &>/dev/null\"\r\n // Format strings used for system recon\r\n $sys_recon1 = \"{\\\"ver\\\":\\\"%x\\\",\\\"mods\\\";[\"\r\n $sys_recon2 = \"uptime: %lu mem_size: %lu mem_free: %lu\"\r\n $sys_recon3 = \"disk_size: %lu disk_free: %lu\"\r\n $sys_recon4 = \"hw: %02x:%02x:%02x:%02x:%02x:%02x\"\r\n // Format string for filepath used to test access to device filesystem\r\n $testpath = \"%s/214688dsf46\"\r\n // Format string for implant configuration filepath\r\n $confpath = \"%s/rootfs_cfg\"\r\n // Default file download path\r\n $downpath = \"/var/tmp/a.tmp\"\r\n\r\n condition:\r\n (uint32(0) == 0x464c457f) and (8 of them)\r\n}", "description": "Detects notable strings identified within the Cyclops Blink executable", "valid_from": "2022-02-21T13:30:15.294Z", "name": "YARA: CyclopsBlink_notable_strings", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1316fd48-a661-4d34-962b-d51c8a11d389", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--1f377bb7-de3f-4153-af8d-d278f5d604aa", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--529be58f-2e13-4a38-a3d3-baadbddcb1e3", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1f377bb7-de3f-4153-af8d-d278f5d604aa", "target_ref": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a535e28e-b29c-443f-8737-5a1f9203de31", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1f377bb7-de3f-4153-af8d-d278f5d604aa", "target_ref": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bffa2f46-2b50-4894-97d2-ae66d634a63c", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1f377bb7-de3f-4153-af8d-d278f5d604aa", "target_ref": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--50be3844-4696-4745-bdba-42a1d32053ea", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1f377bb7-de3f-4153-af8d-d278f5d604aa", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a338f6d9-7df4-49d3-9a5d-3e5af732f47f", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1f377bb7-de3f-4153-af8d-d278f5d604aa", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c2ff0842-c3df-45b7-ae23-3d389dfa7709", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1f377bb7-de3f-4153-af8d-d278f5d604aa", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4babd01b-4051-410a-a0bd-90265efb06c6", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule CyclopsBlink_module_initialisation\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects the code bytes used to initialise the modules built into Cyclops Blink\"\r\n date = \"2022-02-23\"\r\n hash1 = \"3adf9a59743bc5d8399f67cab5eb2daf28b9b863\"\r\n hash2 = \"c59bc17659daca1b1ce65b6af077f86a648ad8a8\"\r\n\r\n strings:\r\n // Module initialisation code bytes, simply returning the module ID\r\n // to the caller\r\n $ = {94 21 FF F0 93 E1 00 08 7C 3F 0B 78 38 00 00 ?? 7C 03\r\n 03 78 81 61 00 00 8E EB FF F8 7D 61 5B 78 4E 80 00 20}\r\n\r\n condition:\r\n (uint32(0) == 0x464c457f) and (any of them)\r\n}", "description": "Detects the code bytes used to initialise the modules built into Cyclops Blink", "valid_from": "2022-02-21T13:30:15.295Z", "name": "YARA: CyclopsBlink_module_initialisation", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--014f799e-36ae-4840-bae7-249afa15fa07", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--4babd01b-4051-410a-a0bd-90265efb06c6", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e3602090-f16e-47de-8425-dc830cc79cc8", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--4babd01b-4051-410a-a0bd-90265efb06c6", "target_ref": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eae5da19-bf14-405c-9c32-257cd042f49d", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--4babd01b-4051-410a-a0bd-90265efb06c6", "target_ref": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f3f99cc5-4acf-4721-9109-92d1e6309a25", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--4babd01b-4051-410a-a0bd-90265efb06c6", "target_ref": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--70b8fd14-3577-4efe-b00e-48b8ad0fc6f9", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--4babd01b-4051-410a-a0bd-90265efb06c6", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3304d16d-c41c-4a27-a3b3-1273abf94119", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--4babd01b-4051-410a-a0bd-90265efb06c6", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a094a78a-a5f7-4c4d-8664-575f638a97b6", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--4babd01b-4051-410a-a0bd-90265efb06c6", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d61d9b01-1d74-42ad-9564-e50d46ebf743", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule CyclopsBlink_modified_install_upgrade\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects notable strings identified within the modified install_upgrade executable, embedded within Cyclops Blink\"\r\n date = \"2022-02-23\"\r\n hash1 = \"3adf9a59743bc5d8399f67cab5eb2daf28b9b863\"\r\n hash2 = \"c59bc17659daca1b1ce65b6af077f86a648ad8a8\"\r\n hash3 = \"7d61c0dd0cd901221a9dff9df09bb90810754f10\"\r\n hash4 = \"438cd40caca70cafe5ca436b36ef7d3a6321e858\"\r\n\r\n strings:\r\n // Format strings used for temporary filenames\r\n $ = \"/pending/%010lu_%06d_%03d_p1\"\r\n $ = \"/pending/sysa_code_dir/test_%d_%d_%d_%d_%d_%d\"\r\n // Hard-coded key used to initialise HMAC calculation\r\n $ = \"etaonrishdlcupfm\"\r\n // Filepath used to store the patched firmware image\r\n $ = \"/pending/WGUpgrade-dl.new\"\r\n // Filepath of legitimate install_upgrade executable\r\n $ = \"/pending/bin/install_upgraded\"\r\n // Loop device IOCTL LOOP_SET_FD\r\n $ = {38 80 4C 00}\r\n // Loop device IOCTL LOOP_GET_STATUS64\r\n $ = {38 80 4C 05}\r\n // Loop device IOCTL LOOP_SET_STATUS64\r\n $ = {38 80 4C 04}\r\n // Firmware HMAC record starts with the string \"HMAC\"\r\n $ = {3C 00 48 4D 60 00 41 43 90 09 00 00}\r\n\r\n condition:\r\n (uint32(0) == 0x464c457f) and (6 of them)\r\n}", "description": "Detects notable strings identified within the modified install_upgrade executable, embedded within Cyclops Blink", "valid_from": "2022-02-21T13:30:15.295Z", "name": "YARA: CyclopsBlink_modified_install_upgrade", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6b7b0161-0623-4f02-ba5c-77a91c3ab411", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--d61d9b01-1d74-42ad-9564-e50d46ebf743", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--af93df6c-cb69-467f-87b0-e9b2ac837fda", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--d61d9b01-1d74-42ad-9564-e50d46ebf743", "target_ref": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f83f2f25-149f-4785-a50f-8924251c0fe7", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--d61d9b01-1d74-42ad-9564-e50d46ebf743", "target_ref": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--939fec04-6acc-4f05-96a6-d0f952947654", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--d61d9b01-1d74-42ad-9564-e50d46ebf743", "target_ref": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0e28cd25-7ab1-41de-91a5-ceec105ac768", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--d61d9b01-1d74-42ad-9564-e50d46ebf743", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--03007452-493a-4d89-a8c9-f2ba8df0fbe1", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--d61d9b01-1d74-42ad-9564-e50d46ebf743", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--efc6cd7a-fcb5-49d5-8b8f-0cf6b7d9e1d7", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--d61d9b01-1d74-42ad-9564-e50d46ebf743", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7578738a-5b2b-423d-b4f0-a44c747b597c", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--d61d9b01-1d74-42ad-9564-e50d46ebf743", "target_ref": "indicator--4a7e6b04-409b-48b7-b60b-117700278e90" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8bbcd2fe-109d-41c7-a8d4-c750a6de8a5b", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--d61d9b01-1d74-42ad-9564-e50d46ebf743", "target_ref": "indicator--fd1ccbde-2620-41e7-b066-6b9960de3698" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b70d206d-324a-4773-b0b2-a9aad026c9b6", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--d61d9b01-1d74-42ad-9564-e50d46ebf743", "target_ref": "indicator--0e9cea64-ac6e-42d3-81e3-2120d79e9813" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8bc9a81a-0f9c-4321-bbaa-a56eb6820389", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--d61d9b01-1d74-42ad-9564-e50d46ebf743", "target_ref": "indicator--c2f04d4c-e200-4153-8700-febf15d36c5e" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--751498d8-f03c-438d-abda-9ae0763217ac", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--d61d9b01-1d74-42ad-9564-e50d46ebf743", "target_ref": "indicator--8e88a48f-cadf-443b-8994-fc321dbffefd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5e54bd63-ee30-4965-a924-3fd79bc6fd0d", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--d61d9b01-1d74-42ad-9564-e50d46ebf743", "target_ref": "indicator--a0d92396-35e9-4500-99c8-27f128239684" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8b4dc4ea-c946-4787-b9be-769cd713f5f6", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule CyclopsBlink_core_command_check\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects the code bytes used to test the command ID being sent to the core component of Cyclops Blink\"\r\n date = \"2022-02-23\"\r\n hash1 = \"3adf9a59743bc5d8399f67cab5eb2daf28b9b863\"\r\n hash2 = \"c59bc17659daca1b1ce65b6af077f86a648ad8a8\"\r\n\r\n strings:\r\n // Check for command ID equals 0x7, 0xa, 0xb, 0xc or 0xd\r\n $cmd_check = {81 3F 00 18 88 09 00 05 54 00 06 3E 2F 80 00\r\n (07|0A|0B|0C|0D)}\r\n\r\n condition:\r\n (uint32(0) == 0x464c457f) and (#cmd_check == 5)\r\n}", "description": "Detects the code bytes used to test the command ID being sent to the core component of Cyclops Blink", "valid_from": "2022-02-21T13:30:15.296Z", "name": "YARA: CyclopsBlink_core_command_check", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e804f952-1790-461f-9b21-a2abacc70b66", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--8b4dc4ea-c946-4787-b9be-769cd713f5f6", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d6f41892-81c3-4b80-bda4-e5d7fe00e95d", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--8b4dc4ea-c946-4787-b9be-769cd713f5f6", "target_ref": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fc21090d-aa56-47b8-b93d-fd29ed684e99", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--8b4dc4ea-c946-4787-b9be-769cd713f5f6", "target_ref": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bf1455c9-9a3f-4db0-b783-2a16b059e1c0", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--8b4dc4ea-c946-4787-b9be-769cd713f5f6", "target_ref": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--19fbf76b-8fb2-4396-9c58-f915b6eff753", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--8b4dc4ea-c946-4787-b9be-769cd713f5f6", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--744820af-f72e-4990-a447-f7b31b7b4346", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--8b4dc4ea-c946-4787-b9be-769cd713f5f6", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4a9632bc-499f-495a-b656-21bc33b1d72e", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--8b4dc4ea-c946-4787-b9be-769cd713f5f6", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--33325033-d063-4ec3-8522-7ec9c53c5b55", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule CyclopsBlink_config_identifiers\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects the initial characters used to identify Cyclops Blink configuration data\"\r\n date = \"2022-02-23\"\r\n hash1 = \"3adf9a59743bc5d8399f67cab5eb2daf28b9b863\"\r\n hash2 = \"c59bc17659daca1b1ce65b6af077f86a648ad8a8\"\r\n\r\n strings:\r\n // Main config parameter data starts with the string \" @test_addmod[math.min(i, #test_addmod)]) and\n (@test_addmod[math.min(i, #test_addmod)] > @test_sc[math.min(i, #test_sc)]) and\n (@test_sc[math.min(i, #test_sc)] > @test_upload[math.min(i, #test_upload)]) and\n ((@test_exec[math.min(i, #test_exec)] - @test_upload[math.min(i, #test_upload)]) <= 0x180)\n )\n )\n}", "description": "Detects the code bytes used to check module ID 0xf control flags and a format string used for file content upload", "valid_from": "2022-02-21T13:30:15.297Z", "name": "YARA: CyclopsBlink_handle_mod_0xf_command", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--64b51ad6-d35a-4128-859d-10231b03b2b1", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--41f9f438-32f7-4404-84d3-c1718c619291", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5d610242-883d-4de5-9133-fe1ff2162533", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--41f9f438-32f7-4404-84d3-c1718c619291", "target_ref": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a9914b36-1049-431e-bd73-f797a3c65efd", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--41f9f438-32f7-4404-84d3-c1718c619291", "target_ref": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d0e7d59f-9b38-40ad-8780-e779be5ba8da", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--41f9f438-32f7-4404-84d3-c1718c619291", "target_ref": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a3272384-7423-439e-9afb-ecc150ed2d92", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--41f9f438-32f7-4404-84d3-c1718c619291", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d44eec23-1535-47be-b4ce-06e38c6d4f4e", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--41f9f438-32f7-4404-84d3-c1718c619291", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bea75cab-7e0e-4126-8621-54a90fed24c6", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--41f9f438-32f7-4404-84d3-c1718c619291", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--69a1a245-2c85-47e3-8e38-ee37e466a329", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule CyclopsBlink_default_config_values\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects the code bytes used to set default Cyclops Blink configuration values\"\r\n date = \"2022-02-23\"\r\n hash1 = \"3adf9a59743bc5d8399f67cab5eb2daf28b9b863\"\r\n hash2 = \"c59bc17659daca1b1ce65b6af077f86a648ad8a8\"\r\n\r\n strings:\r\n // Unknown config value set to 0x19\r\n $ = {38 00 00 19 90 09 01 A4}\r\n // Unknown config value set to 0x18000\r\n $ = {3C 00 00 01 60 00 80 00 90 09 01 A8}\r\n // Unknown config value set to 0x4000\r\n $ = {38 00 40 00 90 09 01 AC}\r\n // Unknown config value set to 0x10b\r\n $ = {38 00 01 0B 90 09 01 B0}\r\n // Unknown config value set to 0x2711\r\n $ = {38 00 27 11 90 09 01 C0}\r\n\r\n condition:\r\n (uint32(0) == 0x464c457f) and (3 of them)\r\n}", "description": "Detects the code bytes used to set default Cyclops Blink configuration values", "valid_from": "2022-02-21T13:30:15.297Z", "name": "YARA: CyclopsBlink_default_config_values", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fb233833-8497-408b-95c0-db2504794bab", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--69a1a245-2c85-47e3-8e38-ee37e466a329", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--824bfd3b-8647-4deb-bd0b-4cb095c3d262", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--69a1a245-2c85-47e3-8e38-ee37e466a329", "target_ref": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ddce2118-19d2-40ff-a328-2f8c4f5a7b81", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--69a1a245-2c85-47e3-8e38-ee37e466a329", "target_ref": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dac2b7d9-33c4-476c-802a-b6e79067fc70", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--69a1a245-2c85-47e3-8e38-ee37e466a329", "target_ref": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f3ea62f0-9c14-46fa-975a-b5148b4bccd0", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--69a1a245-2c85-47e3-8e38-ee37e466a329", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d38f6b79-021b-4b17-a49c-79bd45b724a3", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--69a1a245-2c85-47e3-8e38-ee37e466a329", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f87f1405-4890-4bb2-918a-ad7800be5e25", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--69a1a245-2c85-47e3-8e38-ee37e466a329", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7fd02483-ee1b-46b4-a864-a7b9dd81fd56", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule CyclopsBlink_handle_mod_0x51_command\r\n{\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Detects the code bytes used to check commands sent to module ID 0x51 and notable strings relating to the Cyclops Blink update process\"\r\n date = \"2022-02-23\"\r\n hash1 = \"3adf9a59743bc5d8399f67cab5eb2daf28b9b863\"\r\n hash2 = \"c59bc17659daca1b1ce65b6af077f86a648ad8a8\"\r\n\r\n strings:\r\n // Check for module command ID equals 0x1, 0x2 or 0x3\r\n $cmd_check = {88 1F [2] 54 00 06 3E 2F 80 00 (01|02|03)}\r\n // Legitimate WatchGuard filepaths relating to device configuration\r\n $path1 = \"/etc/wg/configd-hash.xml\"\r\n $path2 = \"/etc/wg/config.xml\"\r\n // Mount arguments used to remount root filesystem as RW or RO\r\n $mnt_arg1 = \"ext2\"\r\n $mnt_arg2 = \"errors=continue\"\r\n $mnt_arg3 = {38 C0 0C 20}\r\n $mnt_arg4 = {38 C0 0C 21}\r\n\r\n condition:\r\n (uint32(0) == 0x464c457f) and (#cmd_check == 3) and\r\n ((@cmd_check[3] - @cmd_check[1]) < 0x200) and\r\n (all of ($path*)) and (all of ($mnt_arg*))\r\n}", "description": "Detects the code bytes used to check commands sent to module ID 0x51 and notable strings relating to the Cyclops Blink update process", "valid_from": "2022-02-21T13:30:15.298Z", "name": "YARA: CyclopsBlink_handle_mod_0x51_command", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--25b0c529-91f8-405d-a066-f507045490a8", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--7fd02483-ee1b-46b4-a864-a7b9dd81fd56", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1c9ba4ef-c124-4336-b332-c8ed8d08268d", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7fd02483-ee1b-46b4-a864-a7b9dd81fd56", "target_ref": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1ecf732b-1df3-46fd-a635-a717ce86253d", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7fd02483-ee1b-46b4-a864-a7b9dd81fd56", "target_ref": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--64822b7b-a932-45d8-903b-76026df3272a", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7fd02483-ee1b-46b4-a864-a7b9dd81fd56", "target_ref": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6d7f4113-aee0-4668-b0dd-723ab16518ae", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7fd02483-ee1b-46b4-a864-a7b9dd81fd56", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--63f6c126-d523-4db3-b1de-7953976d3cf8", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7fd02483-ee1b-46b4-a864-a7b9dd81fd56", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6cb5878a-878e-4caf-a76f-215ceb7e7631", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7fd02483-ee1b-46b4-a864-a7b9dd81fd56", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0071baa3-22e7-4ba9-a3c7-ae7e5e6976f4", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:name = 'cpd' AND file:parent_directory_ref.path = '/usr/bin']", "description": "Path location of Cyclops Blink executable", "valid_from": "2022-02-21T13:30:15.298Z", "name": "Path: /usr/bin/cpd", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3e172c35-b38d-4b86-ba7f-27f04ef95b6b", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--0071baa3-22e7-4ba9-a3c7-ae7e5e6976f4", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--da5660dc-917d-4089-839a-fb5b3ca6315a", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--0071baa3-22e7-4ba9-a3c7-ae7e5e6976f4", "target_ref": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f5a67042-29b8-4614-bb68-71ce41d9abc6", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--0071baa3-22e7-4ba9-a3c7-ae7e5e6976f4", "target_ref": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c61d6c60-6a6f-4a58-8091-262049430f15", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--0071baa3-22e7-4ba9-a3c7-ae7e5e6976f4", "target_ref": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5b75d23f-8a3f-4e03-9539-28e867a21059", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--0071baa3-22e7-4ba9-a3c7-ae7e5e6976f4", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0dc6146c-9975-4a34-84ce-9fc57b91e674", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--0071baa3-22e7-4ba9-a3c7-ae7e5e6976f4", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9a05f14d-18a7-4020-a4dc-6fa394e07cd4", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--0071baa3-22e7-4ba9-a3c7-ae7e5e6976f4", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--87d9941f-00bc-4445-a839-4ac055628457", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:name = 'install_upgraded' AND file:parent_directory_ref.path = '/pending/bin']", "description": "Path location to backed-up legitimate install_upgrade executable", "valid_from": "2022-02-21T13:30:15.299Z", "name": "Path: /pending/bin/install_upgraded", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b51b3c21-0741-4cb0-acd2-221f09732d7d", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--87d9941f-00bc-4445-a839-4ac055628457", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--74de5300-b40e-4a1d-9540-bde45e59a843", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--87d9941f-00bc-4445-a839-4ac055628457", "target_ref": "indicator--4a7e6b04-409b-48b7-b60b-117700278e90" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--283c2216-d15e-4899-aa90-2656cfebf68f", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--87d9941f-00bc-4445-a839-4ac055628457", "target_ref": "indicator--fd1ccbde-2620-41e7-b066-6b9960de3698" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3df0a83c-ddf3-4f27-878e-89f84db1997d", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--87d9941f-00bc-4445-a839-4ac055628457", "target_ref": "indicator--0e9cea64-ac6e-42d3-81e3-2120d79e9813" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--025d9af2-d398-4be2-815f-d358525db099", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--87d9941f-00bc-4445-a839-4ac055628457", "target_ref": "indicator--c2f04d4c-e200-4153-8700-febf15d36c5e" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--50c8223e-16b0-4ee4-8805-fc775714629e", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--87d9941f-00bc-4445-a839-4ac055628457", "target_ref": "indicator--8e88a48f-cadf-443b-8994-fc321dbffefd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7459874f-1195-44a6-a9c7-1b09eb244a3c", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--87d9941f-00bc-4445-a839-4ac055628457", "target_ref": "indicator--a0d92396-35e9-4500-99c8-27f128239684" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7372208e-6c26-4644-8199-845256ea47c2", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '100.43.220.234']", "description": "C2 server IP address", "valid_from": "2022-02-21T13:30:15.299Z", "name": "IPv4: 100.43.220.234", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4061bf0d-ad48-4b06-8316-44878e2376b4", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--7372208e-6c26-4644-8199-845256ea47c2", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--879c9341-3f90-4ace-bd2f-0a1eb3845d6b", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--7372208e-6c26-4644-8199-845256ea47c2", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0121bc97-a4ba-4936-ba42-2884b87d8ec6", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7372208e-6c26-4644-8199-845256ea47c2", "target_ref": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ee19960e-e224-47b4-9c46-a11915944332", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7372208e-6c26-4644-8199-845256ea47c2", "target_ref": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e2058d5e-dac1-4590-8131-bfb4b26fd180", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7372208e-6c26-4644-8199-845256ea47c2", "target_ref": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--89e5d2fc-566b-4225-a5ad-910d6eacbd71", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '96.80.68.193']", "description": "C2 server IP address", "valid_from": "2022-02-21T13:30:15.299Z", "name": "IPv4: 96.80.68.193", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--96c4d5d7-be81-4be0-ae67-e1eadf6a25f1", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--89e5d2fc-566b-4225-a5ad-910d6eacbd71", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b3c6c56f-71be-41e0-afd3-5f3a411fb216", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--89e5d2fc-566b-4225-a5ad-910d6eacbd71", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f936b722-c6a9-46e1-b100-67df1de394c2", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--89e5d2fc-566b-4225-a5ad-910d6eacbd71", "target_ref": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fbc50fee-b532-4dd7-b35c-aa1675509381", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--89e5d2fc-566b-4225-a5ad-910d6eacbd71", "target_ref": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5127455f-bea2-4301-96bd-db18d57f6b05", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--89e5d2fc-566b-4225-a5ad-910d6eacbd71", "target_ref": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e4316d33-31ef-427f-9c6f-aab2cb90e7b2", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '188.152.254.170']", "description": "C2 server IP address", "valid_from": "2022-02-21T13:30:15.299Z", "name": "IPv4: 188.152.254.170", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a7423810-d94b-4fc3-96ef-fd6f10de7bff", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--e4316d33-31ef-427f-9c6f-aab2cb90e7b2", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--38e8779f-22b2-44c1-b986-8883d6eac030", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--e4316d33-31ef-427f-9c6f-aab2cb90e7b2", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f3e83f4d-0511-4351-bc74-41215bdd0a3b", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--e4316d33-31ef-427f-9c6f-aab2cb90e7b2", "target_ref": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bd5cd30d-f417-44f0-834d-4ea89df3bf59", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--e4316d33-31ef-427f-9c6f-aab2cb90e7b2", "target_ref": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--271a85e8-42dd-4823-8bcf-5a92b2388015", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--e4316d33-31ef-427f-9c6f-aab2cb90e7b2", "target_ref": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4ff81de4-fcc6-4529-8b8c-d8e6dc6f5ffe", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '208.81.37.50']", "description": "C2 server IP address", "valid_from": "2022-02-21T13:30:15.300Z", "name": "IPv4: 208.81.37.50", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4b4cd6ed-e2a4-4654-bd3e-32e8f229fb86", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--4ff81de4-fcc6-4529-8b8c-d8e6dc6f5ffe", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--63a6bd13-542d-442f-88cb-19f47d6fb069", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--4ff81de4-fcc6-4529-8b8c-d8e6dc6f5ffe", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f841b8b7-afc5-4104-b681-0867b964b62c", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--4ff81de4-fcc6-4529-8b8c-d8e6dc6f5ffe", "target_ref": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3807fdb0-3676-4d56-b8d8-8fe70d225c7c", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--4ff81de4-fcc6-4529-8b8c-d8e6dc6f5ffe", "target_ref": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4406ced4-a986-434f-b63f-279373d5d5c5", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--4ff81de4-fcc6-4529-8b8c-d8e6dc6f5ffe", "target_ref": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--27ae4c68-5630-4912-917b-b4bf4e34bf5b", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '70.62.153.174']", "description": "C2 server IP address", "valid_from": "2022-02-21T13:30:15.300Z", "name": "IPv4: 70.62.153.174", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e69efa81-8acc-4ed9-940d-a0cb9cd80b14", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--27ae4c68-5630-4912-917b-b4bf4e34bf5b", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9e26699f-13c6-4268-97dd-6cac3caeff7a", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--27ae4c68-5630-4912-917b-b4bf4e34bf5b", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f174c493-76bc-4448-8b38-564262f28ff3", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--27ae4c68-5630-4912-917b-b4bf4e34bf5b", "target_ref": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--91f8d00a-a2ae-4ff1-b20c-1d2a04df65c7", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--27ae4c68-5630-4912-917b-b4bf4e34bf5b", "target_ref": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7e2fe91c-b717-49e4-818b-40307d802d10", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--27ae4c68-5630-4912-917b-b4bf4e34bf5b", "target_ref": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--bde80829-6ced-4e61-a14a-161cf6ddfac3", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '2.230.110.137']", "description": "C2 server IP address", "valid_from": "2022-02-21T13:30:15.300Z", "name": "IPv4: 2.230.110.137", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2b3c1be4-660e-405a-bc9f-c2c583e62273", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--bde80829-6ced-4e61-a14a-161cf6ddfac3", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5b291124-da75-43e5-b7f3-1fabdc9306da", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--bde80829-6ced-4e61-a14a-161cf6ddfac3", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--16391d1b-0870-4294-8c60-4e9bb8322e23", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bde80829-6ced-4e61-a14a-161cf6ddfac3", "target_ref": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bb2a38fd-7f86-415f-abc6-7f6c255c4bc7", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bde80829-6ced-4e61-a14a-161cf6ddfac3", "target_ref": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--65aaf30c-220f-434b-bccc-0f0d3f6c4059", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--bde80829-6ced-4e61-a14a-161cf6ddfac3", "target_ref": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f1fc11c0-27a6-4206-9b05-881b74ba99d4", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '90.63.245.175']", "description": "C2 server IP address", "valid_from": "2022-02-21T13:30:15.301Z", "name": "IPv4: 90.63.245.175", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e68e6250-b6cb-4de7-a05d-befe7af29f30", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--f1fc11c0-27a6-4206-9b05-881b74ba99d4", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1a7099b9-700c-407d-87c4-a0fab5fb86c2", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--f1fc11c0-27a6-4206-9b05-881b74ba99d4", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1a7fdbc1-2dc6-49b2-9598-8ad6c56052d8", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--f1fc11c0-27a6-4206-9b05-881b74ba99d4", "target_ref": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4781e45c-2072-4d17-b8ee-896783ea8614", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--f1fc11c0-27a6-4206-9b05-881b74ba99d4", "target_ref": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e2409c51-1bfb-4d23-b909-8f211cd78f2e", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--f1fc11c0-27a6-4206-9b05-881b74ba99d4", "target_ref": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--51a70813-13ee-4cdc-bb5d-3e1a8e5f9507", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '212.103.208.182']", "description": "C2 server IP address", "valid_from": "2022-02-21T13:30:15.301Z", "name": "IPv4: 212.103.208.182", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9044f9d8-b8ce-4bf2-952f-042b6a83cea3", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--51a70813-13ee-4cdc-bb5d-3e1a8e5f9507", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1db98b95-f8e3-43ca-89ac-0619aec613e6", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--51a70813-13ee-4cdc-bb5d-3e1a8e5f9507", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--29e9b8d8-b73b-4601-95c7-a069f227694d", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--51a70813-13ee-4cdc-bb5d-3e1a8e5f9507", "target_ref": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f705bbb5-e0e8-4af5-a96f-af2a92c679f2", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--51a70813-13ee-4cdc-bb5d-3e1a8e5f9507", "target_ref": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--08cfa698-d0ef-4237-be7f-294f01aa71c2", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--51a70813-13ee-4cdc-bb5d-3e1a8e5f9507", "target_ref": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f364e845-7345-4331-9ca2-91302806270a", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '50.255.126.65']", "description": "C2 server IP address", "valid_from": "2022-02-21T13:30:15.301Z", "name": "IPv4: 50.255.126.65", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--56fa1cef-1e32-4183-bf86-be1cfd40ad35", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--f364e845-7345-4331-9ca2-91302806270a", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b44b8cbd-c97c-4bc7-adbf-f61104c9074b", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--f364e845-7345-4331-9ca2-91302806270a", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--58a7e1a1-86f7-4366-96c5-7c60c6b1bc85", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--f364e845-7345-4331-9ca2-91302806270a", "target_ref": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--58f0defd-652a-4ad4-881d-d2097eea63f3", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--f364e845-7345-4331-9ca2-91302806270a", "target_ref": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6d21c7cc-d0a5-44ba-ace6-db9491923227", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--f364e845-7345-4331-9ca2-91302806270a", "target_ref": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4ab59326-c540-4996-a57c-466fa7646a71", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '78.134.89.167']", "description": "C2 server IP address", "valid_from": "2022-02-21T13:30:15.301Z", "name": "IPv4: 78.134.89.167", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--078e34b5-b7a3-498d-90df-32f7e57af5df", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--4ab59326-c540-4996-a57c-466fa7646a71", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--853d1143-3fa2-4d9c-9d26-4f5232b83fdd", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--4ab59326-c540-4996-a57c-466fa7646a71", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e587df29-b3e7-48ef-b72d-effd69ab8cb9", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--4ab59326-c540-4996-a57c-466fa7646a71", "target_ref": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--333846a8-d7d1-4ca6-bfb8-07ceda1d4797", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--4ab59326-c540-4996-a57c-466fa7646a71", "target_ref": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a321c8c7-3fa9-4f92-b0c1-1a45ee2ae3af", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--4ab59326-c540-4996-a57c-466fa7646a71", "target_ref": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a4d734fb-01db-4b6d-b6aa-b9ed01d78ee4", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '81.4.177.118']", "description": "C2 server IP address", "valid_from": "2022-02-21T13:30:15.302Z", "name": "IPv4: 81.4.177.118", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d6119eae-94af-4b70-a154-e2e9676e0982", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--a4d734fb-01db-4b6d-b6aa-b9ed01d78ee4", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b9b62e25-7f82-4e05-9eb7-02b6e3a83862", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--a4d734fb-01db-4b6d-b6aa-b9ed01d78ee4", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f0290411-6f27-4093-86c9-53a4da574886", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--a4d734fb-01db-4b6d-b6aa-b9ed01d78ee4", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1156b8b8-88d6-4584-a6dc-f9b4fda68ee3", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--a4d734fb-01db-4b6d-b6aa-b9ed01d78ee4", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ee639674-3a12-48e3-8a2b-5144a56636c2", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--a4d734fb-01db-4b6d-b6aa-b9ed01d78ee4", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3670ba95-52f2-4532-bbf5-ae34c9e1e28c", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '24.199.247.222']", "description": "C2 server IP address", "valid_from": "2022-02-21T13:30:15.302Z", "name": "IPv4: 24.199.247.222", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1a84095b-73e3-4d0e-bd20-f227d0d1686f", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--3670ba95-52f2-4532-bbf5-ae34c9e1e28c", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e2b43054-4b3c-46c2-8315-488c5a402db5", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--3670ba95-52f2-4532-bbf5-ae34c9e1e28c", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--55fcbff6-85ed-460d-a6b7-af0136d5fd80", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--3670ba95-52f2-4532-bbf5-ae34c9e1e28c", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1b5f0be2-312c-46a4-a2e0-386636689c54", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--3670ba95-52f2-4532-bbf5-ae34c9e1e28c", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4ff38a3e-8b8d-46d9-9080-be1541d9069e", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--3670ba95-52f2-4532-bbf5-ae34c9e1e28c", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8c2b7294-5bdb-40e0-9dbd-c88a428941aa", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '37.99.163.162']", "description": "C2 server IP address", "valid_from": "2022-02-21T13:30:15.302Z", "name": "IPv4: 37.99.163.162", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e29b772b-0caa-4017-b27a-6a46b6ea486a", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--8c2b7294-5bdb-40e0-9dbd-c88a428941aa", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5b62fd7a-059c-4972-872d-fefefb2733a4", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--8c2b7294-5bdb-40e0-9dbd-c88a428941aa", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f6bcea10-2c57-4c0a-97a2-c8b15b0a2ca0", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--8c2b7294-5bdb-40e0-9dbd-c88a428941aa", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dc5bf4bd-d416-4ae4-9f46-8c090811feec", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--8c2b7294-5bdb-40e0-9dbd-c88a428941aa", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fed10efa-800d-409a-8a4b-b6a24c44fbad", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--8c2b7294-5bdb-40e0-9dbd-c88a428941aa", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--cdfbfcf0-ad90-4fb6-b8af-0f34460d8e4b", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '37.71.147.186']", "description": "C2 server IP address", "valid_from": "2022-02-21T13:30:15.302Z", "name": "IPv4: 37.71.147.186", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1df10e08-af26-4a21-9070-5ded06424ec4", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--cdfbfcf0-ad90-4fb6-b8af-0f34460d8e4b", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--99f2f83f-46e6-4475-aa72-b1cf359034f2", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--cdfbfcf0-ad90-4fb6-b8af-0f34460d8e4b", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4d7e84f0-5394-4d42-8d27-b5f8482a0912", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--cdfbfcf0-ad90-4fb6-b8af-0f34460d8e4b", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3a9e88a0-bad8-424c-b6e1-28c00b8c3b1c", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--cdfbfcf0-ad90-4fb6-b8af-0f34460d8e4b", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4a5a70ed-93e1-478e-8bbf-fff1519c9140", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--cdfbfcf0-ad90-4fb6-b8af-0f34460d8e4b", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--84f744ff-5a06-419e-9729-48fefc9a59b8", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '105.159.248.137']", "description": "C2 server IP address", "valid_from": "2022-02-21T13:30:15.303Z", "name": "IPv4: 105.159.248.137", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--65886c82-332a-4e65-9b8c-1b7a289bf05f", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--84f744ff-5a06-419e-9729-48fefc9a59b8", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a564b3c4-5cad-43f7-ae81-5eb866d08a23", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--84f744ff-5a06-419e-9729-48fefc9a59b8", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e69c6b69-b4ff-4cc9-bb49-aa5347942519", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--84f744ff-5a06-419e-9729-48fefc9a59b8", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a64c99b2-570b-49a9-834f-87f2e1fff52a", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--84f744ff-5a06-419e-9729-48fefc9a59b8", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ed68f857-f0eb-4807-bcc1-81fbf359e7db", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--84f744ff-5a06-419e-9729-48fefc9a59b8", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f0becbcf-0c17-477b-9c76-44ec72555441", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '80.155.38.210']", "description": "C2 server IP address", "valid_from": "2022-02-21T13:30:15.303Z", "name": "IPv4: 80.155.38.210", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7dad327e-ba14-4371-acc4-7f4926d57eac", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--f0becbcf-0c17-477b-9c76-44ec72555441", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7d4809ef-1957-4ab2-b16e-f13c29102498", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--f0becbcf-0c17-477b-9c76-44ec72555441", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0929bd15-3009-4e01-a223-3e8419a23669", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--f0becbcf-0c17-477b-9c76-44ec72555441", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a199b570-84d5-46fc-9c8a-cf4459e5704f", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--f0becbcf-0c17-477b-9c76-44ec72555441", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a6005a4e-da7f-4a80-81cc-9b0a3439c666", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--f0becbcf-0c17-477b-9c76-44ec72555441", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0f227c98-74ee-44da-999a-f6bb95fa12a5", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '217.57.80.18']", "description": "C2 server IP address", "valid_from": "2022-02-21T13:30:15.303Z", "name": "IPv4: 217.57.80.18", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d63513dd-2f21-4c61-9b22-ea3b2bd93e18", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--0f227c98-74ee-44da-999a-f6bb95fa12a5", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--66c5bef1-65b3-4b2f-bc2f-0f6820a456ff", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--0f227c98-74ee-44da-999a-f6bb95fa12a5", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0c5562ac-bdce-43a6-868d-ff4ead680024", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--0f227c98-74ee-44da-999a-f6bb95fa12a5", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5cb9d5db-7e53-4bb3-991a-9b152a97841e", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--0f227c98-74ee-44da-999a-f6bb95fa12a5", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5eeeaaeb-426b-4f46-9c6e-0231981f1cb1", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--0f227c98-74ee-44da-999a-f6bb95fa12a5", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ce5b10d8-2727-4d33-a005-1e16ca1abfdf", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '151.0.169.250']", "description": "C2 server IP address", "valid_from": "2022-02-21T13:30:15.304Z", "name": "IPv4: 151.0.169.250", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--db36afe9-8bac-4aec-9f49-ee7862105dc1", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--ce5b10d8-2727-4d33-a005-1e16ca1abfdf", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2251638e-b227-48a9-a92a-b377c6b217de", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--ce5b10d8-2727-4d33-a005-1e16ca1abfdf", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--33cf9fbf-1c56-4ed3-b785-457b7b91731c", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--ce5b10d8-2727-4d33-a005-1e16ca1abfdf", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c0f00137-3ef3-4ed2-a7b7-c2e555613903", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--ce5b10d8-2727-4d33-a005-1e16ca1abfdf", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6becc8b6-77f9-437a-808d-ee65af088215", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--ce5b10d8-2727-4d33-a005-1e16ca1abfdf", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7bac2a19-2b9d-43c3-8499-625fd223b393", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '212.202.147.10']", "description": "C2 server IP address", "valid_from": "2022-02-21T13:30:15.304Z", "name": "IPv4: 212.202.147.10", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--63171591-e4e5-4c6b-a32a-7886d4e4b526", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--7bac2a19-2b9d-43c3-8499-625fd223b393", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--28fb913b-6446-456f-9109-44f71f7bb4b5", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--7bac2a19-2b9d-43c3-8499-625fd223b393", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ae47ea75-4ce3-4839-ae67-8a580195fad0", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7bac2a19-2b9d-43c3-8499-625fd223b393", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f5e166e6-02e5-4d5c-b167-f1baab2c76dd", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7bac2a19-2b9d-43c3-8499-625fd223b393", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b05662f8-cd01-44a7-bef7-6a2eda2a8a7b", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7bac2a19-2b9d-43c3-8499-625fd223b393", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--42e5f74d-58b0-4084-bfe7-967dd5850834", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '212.234.179.113']", "description": "C2 server IP address", "valid_from": "2022-02-21T13:30:15.304Z", "name": "IPv4: 212.234.179.113", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c2cb43d6-e5cb-41f3-a3fa-cffabbb05f6b", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--42e5f74d-58b0-4084-bfe7-967dd5850834", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--21eaff68-a965-46d2-8482-5ca8fef24ea6", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--42e5f74d-58b0-4084-bfe7-967dd5850834", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a22d6696-0c0a-4254-acce-87dde18f6736", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--42e5f74d-58b0-4084-bfe7-967dd5850834", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9c43cc75-93a8-48ec-b531-93d9307d12c7", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--42e5f74d-58b0-4084-bfe7-967dd5850834", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3eef8b12-83db-4233-a0a9-1328ddb47a3f", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--42e5f74d-58b0-4084-bfe7-967dd5850834", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5f531571-2a61-4697-9cdd-af4478f5ee60", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '185.82.169.99']", "description": "C2 server IP address", "valid_from": "2022-02-21T13:30:15.304Z", "name": "IPv4: 185.82.169.99", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6ccbdcd1-4306-4879-b25e-7b93519a2592", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--5f531571-2a61-4697-9cdd-af4478f5ee60", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a0370934-1155-4cb7-b335-3d0fe28e2325", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--5f531571-2a61-4697-9cdd-af4478f5ee60", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--78a08339-9184-48ec-9778-628c8260a741", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--5f531571-2a61-4697-9cdd-af4478f5ee60", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eacd686c-c347-4dbc-b36e-0524c4129820", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--5f531571-2a61-4697-9cdd-af4478f5ee60", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6f12cb8a-6d56-4b31-bba5-7d3381428490", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--5f531571-2a61-4697-9cdd-af4478f5ee60", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--176a8872-1468-4459-ab49-0ba6d815a0e4", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '93.51.177.66']", "description": "C2 server IP address", "valid_from": "2022-02-21T13:30:15.305Z", "name": "IPv4: 93.51.177.66", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d81f6e63-979a-4b82-8d99-e66dc80f3576", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--176a8872-1468-4459-ab49-0ba6d815a0e4", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--557f9057-6b69-45c6-954e-57abc97b1391", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--176a8872-1468-4459-ab49-0ba6d815a0e4", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7042bd96-51c8-4ae4-afe9-30e4bdfb954d", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--176a8872-1468-4459-ab49-0ba6d815a0e4", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e02fd82c-2a92-429f-b555-ccdb459d0c31", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--176a8872-1468-4459-ab49-0ba6d815a0e4", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8429e02d-e54e-42a8-b5c9-b2c10ffb3d00", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--176a8872-1468-4459-ab49-0ba6d815a0e4", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--96ca2c87-c2b0-42c6-aa13-fa1c6d208a27", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '80.15.113.188']", "description": "C2 server IP address", "valid_from": "2022-02-21T13:30:15.305Z", "name": "IPv4: 80.15.113.188", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--745eb2f7-cdbb-4652-961b-25e39fcd4631", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--96ca2c87-c2b0-42c6-aa13-fa1c6d208a27", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a3127223-ade2-4c6c-8720-c573d255d452", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--96ca2c87-c2b0-42c6-aa13-fa1c6d208a27", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b5d8983b-b7f2-4322-832c-6d4b22e6caf1", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--96ca2c87-c2b0-42c6-aa13-fa1c6d208a27", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--aa22f1b4-7741-4568-bef3-79e15bf3fb13", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--96ca2c87-c2b0-42c6-aa13-fa1c6d208a27", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c0fcbbe4-3f07-4e11-a63a-437e4f2d6c9e", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--96ca2c87-c2b0-42c6-aa13-fa1c6d208a27", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--dcff5e4d-f55c-4ce3-8d63-6c93e6343c46", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '80.153.75.103']", "description": "C2 server IP address", "valid_from": "2022-02-21T13:30:15.305Z", "name": "IPv4: 80.153.75.103", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f4aaa21d-cbc1-4d7c-a895-c15c0e7a7ff9", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--dcff5e4d-f55c-4ce3-8d63-6c93e6343c46", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4ce02aa7-2338-4d38-877e-7995660a13c8", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--dcff5e4d-f55c-4ce3-8d63-6c93e6343c46", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dbe14510-7952-4839-9cdd-9b880083b76a", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--dcff5e4d-f55c-4ce3-8d63-6c93e6343c46", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d6a3fee1-8f62-451e-b71e-c63709785150", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--dcff5e4d-f55c-4ce3-8d63-6c93e6343c46", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cd5c7da7-be37-425b-a6d6-b98546eb9175", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--dcff5e4d-f55c-4ce3-8d63-6c93e6343c46", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--89f43085-f61e-4d55-88c5-b52cfd091315", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[ipv4-addr:value = '109.192.30.125']", "description": "C2 server IP address", "valid_from": "2022-02-21T13:30:15.305Z", "name": "IPv4: 109.192.30.125", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0dcd9ada-99de-4e29-8052-09fc76ceaaed", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--89f43085-f61e-4d55-88c5-b52cfd091315", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a211b3b7-2938-4add-a249-94906952c7dc", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--89f43085-f61e-4d55-88c5-b52cfd091315", "target_ref": "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ea0575fc-f08b-491a-beb0-0dbb8bdc1809", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--89f43085-f61e-4d55-88c5-b52cfd091315", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cf7e2a94-8110-4421-8169-ffec56ebd0a0", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--89f43085-f61e-4d55-88c5-b52cfd091315", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d5bbb803-d4ce-4dc9-8151-c5db5f10c697", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--89f43085-f61e-4d55-88c5-b52cfd091315", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5dd168a2-07af-438c-bc9c-9382cada1345", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:name = 'a.tmp' AND file:parent_directory_ref.path = '/var/tmp']", "description": "Default path location for downloaded files", "valid_from": "2022-02-21T13:30:15.306Z", "name": "Path: /var/tmp/a.tmp", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2e96a86d-dc9a-49c8-90ef-a6c47f3220cd", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--5dd168a2-07af-438c-bc9c-9382cada1345", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f8d29445-9318-4f68-b176-302d65517e4f", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--5dd168a2-07af-438c-bc9c-9382cada1345", "target_ref": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5e9ab86d-11be-4f1a-96a3-8a0703263614", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--5dd168a2-07af-438c-bc9c-9382cada1345", "target_ref": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6ec84e5b-2e99-42a0-b52d-de399792f240", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--5dd168a2-07af-438c-bc9c-9382cada1345", "target_ref": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b73cb231-d1c5-4355-ba85-6dcba1d37704", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--5dd168a2-07af-438c-bc9c-9382cada1345", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--016969c4-3bc9-4a59-84c5-ebde23ef8f75", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--5dd168a2-07af-438c-bc9c-9382cada1345", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4ed08512-e613-4347-8994-ac3df941ce16", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--5dd168a2-07af-438c-bc9c-9382cada1345", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c07d0ce5-e96e-463d-8259-7632d33db5e3", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:name = 'rootfs_cfg']", "description": "Name of file used to persist C2 server IP addresses on the device filesystem", "valid_from": "2022-02-21T13:30:15.306Z", "name": "Filename: rootfs_cfg", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--456127c2-8507-45a3-b750-f490655e2493", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--c07d0ce5-e96e-463d-8259-7632d33db5e3", "target_ref": "malware--980eca41-a8a0-4ccb-8904-44bb3d428566" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6e0f1248-770b-4875-8350-6f7223a6bc1a", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--c07d0ce5-e96e-463d-8259-7632d33db5e3", "target_ref": "indicator--9a701cb2-e67e-43e4-b921-0c467b913617" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eef155c0-2552-4bf3-9fc8-2ed09144cf13", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--c07d0ce5-e96e-463d-8259-7632d33db5e3", "target_ref": "indicator--698c7a42-ded2-480d-a138-d3c959f40a49" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--07aa7b14-a0cc-4447-8fe8-975d423052dd", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--c07d0ce5-e96e-463d-8259-7632d33db5e3", "target_ref": "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--36f18ee3-ad11-40d4-8933-332a8b08abaa", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--c07d0ce5-e96e-463d-8259-7632d33db5e3", "target_ref": "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--465d1030-695f-4648-81e0-525ecd401d7a", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--c07d0ce5-e96e-463d-8259-7632d33db5e3", "target_ref": "indicator--f3f67205-8b26-4091-8822-f35cafc027e9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a8ea5e93-f4da-4ac3-98ca-ecf2a0900f3b", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--c07d0ce5-e96e-463d-8259-7632d33db5e3", "target_ref": "indicator--c7489ade-b373-465f-896f-43431c725090" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487", "created": "2022-10-01T00:00:00.000Z", "modified": "2022-10-01T00:00:00.000Z", "name": "TLP:CLEAR", "extensions": { "extension-definition--60a3c5c5-0d10-413e-aab3-9e08dde9e88d": { "extension_type": "property-extension", "tlp_2_0" : "clear" } } }, { "type": "identity", "spec_version": "2.1", "id": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "created": "2021-05-20T12:00:00.000Z", "modified": "2021-05-20T12:00:00.000Z", "name": "NCSC", "contact_information": "https://ncsc.gov.uk/section/about-this-website/contact-us" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a9d4b653-6915-42af-98b2-5758c4ceee56", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "name": "Unix Shell", "x_mitre_data_sources": [ "Command: Command Execution", "Process: Process Creation" ], "x_mitre_version": "1.1", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ], "x_mitre_platforms": [ "macOS", "Linux" ], "x_mitre_is_subtechnique": true, "x_mitre_permissions_required": [ "User", "root" ], "description": "Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux and macOS systems, though many variations of the Unix shell exist (e.g. sh, bash, zsh, etc.) depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.\n\nUnix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.\n\nAdversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with [SSH](https://attack.mitre.org/techniques/T1021/004). Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.", "x_mitre_remote_support": true, "x_mitre_detection": "Unix shell usage may be common on administrator, developer, or power user systems, depending on job function. If scripting is restricted for normal users, then any attempt to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.\n\nScripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information discovery, collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script. ", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "external_references": [ { "url": "https://attack.mitre.org/techniques/T1059/004", "external_id": "T1059.004", "source_name": "mitre-attack" }, { "url": "https://linux.die.net/man/1/bash", "description": "die.net. (n.d.). bash(1) - Linux man page. Retrieved June 12, 2020.", "source_name": "DieNet Bash" }, { "url": "https://support.apple.com/HT208050", "description": "Apple. (2020, January 28). Use zsh as the default shell on your Mac. Retrieved June 12, 2020.", "source_name": "Apple ZShell" } ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--dca670cf-eeec-438f-8185-fd959d9ef211", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "description": "Adversaries may establish persistence by modifying RC scripts which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify.\n\nAdversaries can establish persistence by adding a malicious binary path or shell commands to rc.local, rc.common, and other RC scripts specific to the Unix-like distribution.(Citation: IranThreats Kittens Dec 2017)(Citation: Intezer HiddenWasp Map 2019) Upon reboot, the system executes the script's contents as root, resulting in persistence.\n\nAdversary abuse of RC scripts is especially effective for lightweight Unix-like distributions using the root user as default, such as IoT or embedded systems.(Citation: intezer-kaiji-malware)\n\nSeveral Unix-like systems have moved to Systemd and deprecated the use of RC scripts. This is now a deprecated mechanism in macOS in favor of [Launchd](https://attack.mitre.org/techniques/T1053/004). (Citation: Apple Developer Doco Archive Launchd)(Citation: Startup Items) This technique can be used on Mac OS X Panther v10.3 and earlier versions which still execute the RC scripts.(Citation: Methods of Mac Malware Persistence) To maintain backwards compatibility some systems, such as Ubuntu, will execute the RC scripts if they exist with the correct file permissions.(Citation: Ubuntu Manpage systemd rc)", "name": "RC Scripts", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1037.004", "url": "https://attack.mitre.org/techniques/T1037/004" }, { "source_name": "IranThreats Kittens Dec 2017", "url": "https://iranthreats.github.io/resources/attribution-flying-rocket-kitten/", "description": "Iran Threats . (2017, December 5). Flying Kitten to Rocket Kitten, A Case of Ambiguity and Shared Code. Retrieved May 28, 2020." }, { "description": "Sanmillan, I. (2019, May 29). HiddenWasp Malware Stings Targeted Linux Systems. Retrieved June 24, 2019.", "url": "https://www.intezer.com/blog-hiddenwasp-malware-targeting-linux-systems/", "source_name": "Intezer HiddenWasp Map 2019" }, { "source_name": "intezer-kaiji-malware", "url": "https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/", "description": "Paul Litvak. (2020, May 4). Kaiji: New Chinese Linux malware turning to Golang. Retrieved December 17, 2020." }, { "source_name": "Apple Developer Doco Archive Launchd", "url": "https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html", "description": "Apple. (2016, September 13). Daemons and Services Programming Guide - Creating Launch Daemons and Agents. Retrieved February 24, 2021." }, { "url": "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html", "description": "Apple. (2016, September 13). Startup Items. Retrieved July 11, 2017.", "source_name": "Startup Items" }, { "url": "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf", "description": "Patrick Wardle. (2014, September). Methods of Malware Persistence on Mac OS X. Retrieved July 5, 2017.", "source_name": "Methods of Mac Malware Persistence" }, { "source_name": "Ubuntu Manpage systemd rc", "url": "http://manpages.ubuntu.com/manpages/bionic/man8/systemd-rc-local-generator.8.html", "description": "Canonical Ltd.. (n.d.). systemd-rc-local-generator - Compatibility generator for starting /etc/rc.local and /usr/sbin/halt.local during boot and shutdown. Retrieved February 23, 2021." } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" }, { "kill_chain_name": "mitre-attack", "phase_name": "privilege-escalation" } ], "x_mitre_platforms": [ "macOS", "Linux" ], "x_mitre_data_sources": [ "File: File Creation", "File: File Modification", "Process: Process Creation", "Command: Command Execution" ], "x_mitre_detection": "Monitor for unexpected changes to RC scripts in the /etc/ directory. Monitor process execution resulting from RC scripts for unusual or unknown applications or behavior.\n\nMonitor for /etc/rc.local file creation. Although types of RC scripts vary for each Unix-like distribution, several execute /etc/rc.local if present. ", "x_mitre_permissions_required": [ "root" ], "x_mitre_is_subtechnique": true, "x_mitre_version": "2.0", "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--16ab6452-c3c1-497c-a47d-206018ca1ada", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "description": "Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer. (Citation: Wikipedia BIOS) (Citation: Wikipedia UEFI) (Citation: About UEFI)\n\nSystem firmware like BIOS and (U)EFI underly the functionality of a computer and may be modified by an adversary to perform or assist in malicious activity. Capabilities exist to overwrite the system firmware, which may give sophisticated adversaries a means to install malicious firmware updates as a means of persistence on a system that may be difficult to detect.", "name": "System Firmware", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1542.001", "url": "https://attack.mitre.org/techniques/T1542/001" }, { "external_id": "CAPEC-532", "source_name": "capec", "url": "https://capec.mitre.org/data/definitions/532.html" }, { "url": "https://en.wikipedia.org/wiki/BIOS", "description": "Wikipedia. (n.d.). BIOS. Retrieved January 5, 2016.", "source_name": "Wikipedia BIOS" }, { "url": "https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface", "description": "Wikipedia. (2017, July 10). Unified Extensible Firmware Interface. Retrieved July 11, 2017.", "source_name": "Wikipedia UEFI" }, { "url": "http://www.uefi.org/about", "description": "UEFI Forum. (n.d.). About UEFI Forum. Retrieved January 5, 2016.", "source_name": "About UEFI" }, { "url": "http://www.mitre.org/publications/project-stories/going-deep-into-the-bios-with-mitre-firmware-security-research", "description": "Upham, K. (2014, March). Going Deep into the BIOS with MITRE Firmware Security Research. Retrieved January 5, 2016.", "source_name": "MITRE Trustworthy Firmware Measurement" }, { "url": "http://www.mitre.org/capabilities/cybersecurity/overview/cybersecurity-blog/copernicus-question-your-assumptions-about", "description": "Butterworth, J. (2013, July 30). Copernicus: Question Your Assumptions about BIOS Security. Retrieved December 11, 2015.", "source_name": "MITRE Copernicus" }, { "url": "https://securingtomorrow.mcafee.com/business/chipsec-support-vault-7-disclosure-scanning/", "description": "Beek, C., Samani, R. (2017, March 8). CHIPSEC Support Against Vault 7 Disclosure Scanning. Retrieved March 13, 2017.", "source_name": "McAfee CHIPSEC Blog" }, { "url": "https://github.com/chipsec/chipsec", "description": "Intel. (2017, March 18). CHIPSEC Platform Security Assessment Framework. Retrieved March 20, 2017.", "source_name": "Github CHIPSEC" }, { "url": "http://www.intelsecurity.com/advanced-threat-research/content/data/HT-UEFI-rootkit.html", "description": "Intel Security. (2005, July 16). HackingTeam's UEFI Rootkit Details. Retrieved March 20, 2017.", "source_name": "Intel HackingTeam UEFI Rootkit" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" }, { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "x_mitre_platforms": [ "Windows" ], "x_mitre_contributors": [ "Jean-Ian Boutin, ESET", "McAfee", "Ryan Becwar" ], "x_mitre_data_sources": [ "Firmware: Firmware Modification" ], "x_mitre_detection": "System firmware manipulation may be detected. (Citation: MITRE Trustworthy Firmware Measurement) Dump and inspect BIOS images on vulnerable systems and compare against known good images. (Citation: MITRE Copernicus) Analyze differences to determine if malicious changes have occurred. Log attempts to read/write to BIOS and compare against known patching behavior.\n\nLikewise, EFI modules can be collected and compared against a known-clean list of EFI executable binaries to detect potentially malicious modules. The CHIPSEC framework can be used for analysis to determine if firmware modifications have been performed. (Citation: McAfee CHIPSEC Blog) (Citation: Github CHIPSEC) (Citation: Intel HackingTeam UEFI Rootkit)", "x_mitre_permissions_required": [ "Administrator", "SYSTEM" ], "x_mitre_is_subtechnique": true, "x_mitre_version": "1.0", "x_mitre_defense_bypassed": [ "Host intrusion prevention systems", "Anti-virus", "File monitoring" ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--354a7f88-63fb-41b5-a801-ce3b377b36f1", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "name": "System Information Discovery", "x_mitre_data_sources": [ "Instance: Instance Metadata", "Process: Process Creation", "Command: Command Execution", "Process: OS API Execution" ], "x_mitre_version": "2.3", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "discovery" } ], "x_mitre_platforms": [ "Windows", "IaaS", "Linux", "macOS" ], "x_mitre_is_subtechnique": false, "x_mitre_permissions_required": [ "User" ], "description": "An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from [System Information Discovery](https://attack.mitre.org/techniques/T1082) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\nTools such as [Systeminfo](https://attack.mitre.org/software/S0096) can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. As an example, adversaries with user-level access can execute the df -aH command to obtain currently mounted disks and associated freely available space. [System Information Discovery](https://attack.mitre.org/techniques/T1082) combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.(Citation: OSX.FairyTale)(Citation: 20 macOS Common Tools and Techniques)\n\nInfrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API)", "x_mitre_contributors": [ "Maril Vernon @shewhohacks", "Praetorian" ], "x_mitre_detection": "System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.\n\nMonitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).\n\nIn cloud-based systems, native logging can be used to identify access to certain APIs and dashboards that may contain system information. Depending on how the environment is used, that data alone may not be useful due to benign use during normal operations.", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "external_references": [ { "url": "https://attack.mitre.org/techniques/T1082", "external_id": "T1082", "source_name": "mitre-attack" }, { "url": "https://capec.mitre.org/data/definitions/312.html", "external_id": "CAPEC-312", "source_name": "capec" }, { "url": "https://www.sentinelone.com/blog/trail-osx-fairytale-adware-playing-malware/", "description": "Phile Stokes. (2018, September 20). On the Trail of OSX.FairyTale | Adware Playing at Malware. Retrieved August 24, 2021.", "source_name": "OSX.FairyTale" }, { "url": "https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/", "description": "Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.", "source_name": "20 macOS Common Tools and Techniques" }, { "url": "https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-instance-information.html", "description": "Amazon. (n.d.). describe-instance-information. Retrieved March 3, 2020.", "source_name": "Amazon Describe Instance" }, { "url": "https://cloud.google.com/compute/docs/reference/rest/v1/instances", "description": "Google. (n.d.). Rest Resource: instance. Retrieved March 3, 2020.", "source_name": "Google Instances Resource" }, { "source_name": "Microsoft Virutal Machine API", "description": "Microsoft. (2019, March 1). Virtual Machines - Get. Retrieved October 8, 2019.", "url": "https://docs.microsoft.com/en-us/rest/api/compute/virtualmachines/get" } ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d467bc38-284b-4a00-96ac-125f447799fc", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "description": "Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a non-standard data encoding system that diverges from existing protocol specifications. Non-standard data encoding schemes may be based on or related to standard data encoding schemes, such as a modified Base64 encoding for the message body of an HTTP request.(Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding) ", "name": "Non-Standard Encoding", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1132.002", "url": "https://attack.mitre.org/techniques/T1132/002" }, { "url": "https://en.wikipedia.org/wiki/Binary-to-text_encoding", "description": "Wikipedia. (2016, December 26). Binary-to-text encoding. Retrieved March 1, 2017.", "source_name": "Wikipedia Binary-to-text Encoding" }, { "url": "https://en.wikipedia.org/wiki/Character_encoding", "description": "Wikipedia. (2017, February 19). Character Encoding. Retrieved March 1, 2017.", "source_name": "Wikipedia Character Encoding" }, { "url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf", "description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.", "source_name": "University of Birmingham C2" } ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_mitre_data_sources": [ "Network Traffic: Network Traffic Content" ], "x_mitre_detection": "Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)", "x_mitre_permissions_required": [ "User" ], "x_mitre_is_subtechnique": true, "x_mitre_version": "1.0", "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f24faf46-3b26-4dbb-98f2-63460498e433", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Fallback Channels", "description": "Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1008", "external_id": "T1008" }, { "url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf", "description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.", "source_name": "University of Birmingham C2" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_platforms": [ "Linux", "Windows", "macOS" ], "x_mitre_network_requirements": true, "x_mitre_detection": "Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)", "x_mitre_data_sources": [ "Network Traffic: Network Traffic Flow", "Network Traffic: Network Connection Creation" ], "x_mitre_version": "1.0", "x_mitre_is_subtechnique": false, "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--df8b2a25-8bdf-4856-953c-a04372b1c161", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1071.001", "url": "https://attack.mitre.org/techniques/T1071/001" }, { "url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf", "description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.", "source_name": "University of Birmingham C2" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Web Protocols", "description": "Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. \n\nProtocols such as HTTP and HTTPS that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic. ", "x_mitre_version": "1.0", "x_mitre_is_subtechnique": true, "x_mitre_detection": "Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect application layer protocols that do not follow the expected protocol standards regarding syntax, structure, or any other variable adversaries could leverage to conceal data.(Citation: University of Birmingham C2)\n\nMonitor for web traffic to/from known-bad or suspicious domains. ", "x_mitre_data_sources": [ "Network Traffic: Network Traffic Flow", "Network Traffic: Network Traffic Content" ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--bf176076-b789-408e-8cba-7275e81c0ada", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "description": "Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal.\n\nFor efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002).", "name": "Asymmetric Cryptography", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1573.002", "url": "https://attack.mitre.org/techniques/T1573/002" }, { "url": "http://www.sans.org/reading-room/whitepapers/analyst/finding-hidden-threats-decrypting-ssl-34840", "description": "Butler, M. (2013, November). Finding Hidden Threats by Decrypting SSL. Retrieved April 5, 2016.", "source_name": "SANS Decrypting SSL" }, { "url": "https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-inspection.html", "description": "Dormann, W. (2015, March 13). The Risks of SSL Inspection. Retrieved April 5, 2016.", "source_name": "SEI SSL Inspection Risks" }, { "url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf", "description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.", "source_name": "University of Birmingham C2" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_mitre_data_sources": [ "Network Traffic: Network Traffic Content" ], "x_mitre_detection": "SSL/TLS inspection is one way of detecting command and control traffic within some encrypted communication channels.(Citation: SANS Decrypting SSL) SSL/TLS inspection does come with certain risks that should be considered before implementing to avoid potential security issues such as incomplete certificate validation.(Citation: SEI SSL Inspection Risks)\n\nIn general, analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)", "x_mitre_is_subtechnique": true, "x_mitre_version": "1.0", "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b18eae87-b469-4e14-b454-b171b416bc18", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "description": "Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.", "name": "Non-Standard Port", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1571", "url": "https://attack.mitre.org/techniques/T1571" }, { "source_name": "Symantec Elfin Mar 2019", "url": "https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage", "description": "Security Response attack Investigation Team. (2019, March 27). Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.. Retrieved April 10, 2019." }, { "source_name": "Fortinet Agent Tesla April 2018", "url": "https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant.html", "description": "Zhang, X. (2018, April 05). Analysis of New Agent Tesla Spyware Variant. Retrieved November 5, 2018." }, { "url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf", "description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.", "source_name": "University of Birmingham C2" } ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_mitre_data_sources": [ "Network Traffic: Network Traffic Flow", "Network Traffic: Network Connection Creation", "Network Traffic: Network Traffic Content" ], "x_mitre_detection": "Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.(Citation: University of Birmingham C2)", "x_mitre_is_subtechnique": false, "x_mitre_version": "1.0", "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--92d7da27-2d91-488e-a00c-059dc162766d", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "name": "Exfiltration Over C2 Channel", "external_references": [ { "url": "https://attack.mitre.org/techniques/T1041", "external_id": "T1041", "source_name": "mitre-attack" }, { "source_name": "University of Birmingham C2", "description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.", "url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf" } ], "x_mitre_data_sources": [ "Network Traffic: Network Connection Creation", "Network Traffic: Network Traffic Flow", "Network Traffic: Network Traffic Content", "File: File Access", "Command: Command Execution" ], "x_mitre_version": "2.1", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "exfiltration" } ], "x_mitre_network_requirements": true, "x_mitre_is_subtechnique": false, "description": "Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.", "x_mitre_contributors": [ "William Cain" ], "x_mitre_detection": "Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)", "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5372c5fe-f424-4def-bcd5-d3a8e770f07b", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1562.004", "url": "https://attack.mitre.org/techniques/T1562/004" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Disable or Modify System Firewall", "description": "Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.\n\nModifying or disabling a system firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed. ", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "x_mitre_version": "1.0", "x_mitre_is_subtechnique": true, "x_mitre_defense_bypassed": [ "Firewall" ], "x_mitre_detection": "Monitor processes and command-line arguments to see if firewalls are disabled or modified. Monitor Registry edits to keys that manage firewalls.", "x_mitre_data_sources": [ "Command: Command Execution", "Windows Registry: Windows Registry Key Modification", "Firewall: Firewall Disable", "Firewall: Firewall Rule Modification" ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "description": "Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). In containerized environments, this may also be done by creating a resource in a namespace that matches the naming convention of a container pod or cluster. Alternatively, a file or container image name given may be a close approximation to legitimate programs/images or something innocuous.\n\nAdversaries may also use the same icon of the file they are trying to mimic.", "name": "Match Legitimate Name or Location", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1036.005", "url": "https://attack.mitre.org/techniques/T1036/005" }, { "external_id": "CAPEC-177", "source_name": "capec", "url": "https://capec.mitre.org/data/definitions/177.html" }, { "source_name": "Elastic Masquerade Ball", "description": "Ewing, P. (2016, October 31). How to Hunt: The Masquerade Ball. Retrieved October 31, 2016.", "url": "http://pages.endgame.com/rs/627-YBU-612/images/EndgameJournal_The%20Masquerade%20Ball_Pages_R2.pdf" }, { "source_name": "Twitter ItsReallyNick Masquerading Update", "url": "https://twitter.com/ItsReallyNick/status/1055321652777619457", "description": "Carr, N.. (2018, October 25). Nick Carr Status Update Masquerading. Retrieved April 22, 2019." }, { "source_name": "Docker Images", "url": "https://docs.docker.com/engine/reference/commandline/images/", "description": "Docker. (n.d.). Docker Images. Retrieved April 6, 2021." } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ], "x_mitre_platforms": [ "Linux", "macOS", "Windows", "Containers" ], "x_mitre_data_sources": [ "Image: Image Metadata", "File: File Metadata", "Process: Process Metadata" ], "x_mitre_detection": "Collect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Likewise, files that are modified outside of an update or patch are suspect.\n\nIf file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. (Citation: Elastic Masquerade Ball) Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.(Citation: Twitter ItsReallyNick Masquerading Update)\n\nIn containerized environments, use image IDs and layer hashes to compare images instead of relying only on their names.(Citation: Docker Images) Monitor for the unexpected creation of new resources within your cluster in Kubernetes, especially those created by atypical users.", "x_mitre_defense_bypassed": [ "Application control by file name or path" ], "x_mitre_is_subtechnique": true, "x_mitre_version": "1.1", "x_mitre_contributors": [ "Yossi Weizman, Azure Defender Research Team", "Vishwas Manral, McAfee" ], "x_killchain": "mitre-attack" }, { "type": "report", "spec_version": "2.1", "id": "report--765e45f5-91f0-40c6-b677-0d035c2e6fc7", "created": "2022-02-23T00:00:00.000Z", "modified": "2022-02-23T00:00:00.000Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Malware Analysis Report: Cyclops Blink", "description": "Modular malware framework targeting SOHO network devices. Cyclops Blink is a malicious Linux ELF executable, compiled for the 32-bit PowerPC (big-endian) architecture. Persistence is maintained throughout the legitimate device firmware update process. Implements a modular framework consisting of a core component and additional modules that are executed as child processes. Modules to download/upload files, extract device information, and update the malware have been built-in and are executed at startup. Command and control (C2) communication uses a custom binary protocol underneath TLS, and messages are individually encrypted.", "published": "2022-02-23T00:00:00Z", "external_references": [ { "source_name": "NCSC", "external_id": "NCSC/MAR/Cyclops-Blink" } ], "report_types": [ "malware" ], "object_refs": [ "malware--980eca41-a8a0-4ccb-8904-44bb3d428566", "attack-pattern--c63a5841-2c14-43dd-9bf6-7e2b35dd80aa", "relationship--07cab05d-5a1e-4b90-b749-bdce5e0deb3e", "relationship--d8744a52-30e6-4327-949e-0631b1be8407", "attack-pattern--df25da3d-9849-49b8-bfa9-f54504150e02", "relationship--62e69a2d-1511-427e-a90e-3aab83eb3fa9", "relationship--9482db78-b333-4972-ab6e-1c0319289557", "attack-pattern--ca7eeeee-5902-4f54-b8ac-6ddfd51a8787", "relationship--4cafdce8-bf30-484c-adb7-128d131ddb4a", "relationship--e1e27e5f-3659-4772-84ce-3d40a7ff2a2a", "attack-pattern--e6a965ea-f4f6-4acb-8b28-ec9cea9dae32", "relationship--91d832a0-6ad4-48e8-9cff-3e3af39484b5", "relationship--157fb8d7-7086-4ad6-9aea-c251c8415cab", "attack-pattern--116cce2d-a609-4054-a041-44dc848e2008", "relationship--b8669cf6-df5f-4a92-ae45-00a28c284d97", "relationship--e0a85f64-2066-4575-b1ea-2a02a9930630", "attack-pattern--e78031f3-3c75-4fa8-ad1d-ee5265be100d", "relationship--56a7b44b-b2ae-48e6-b823-db6adda73d83", "relationship--b9aa5571-177b-4fcf-98c2-ce15fb9ca26c", "attack-pattern--87f87492-7659-47e7-b18d-e956b656cbcd", "relationship--e333fe29-0488-4309-a005-035879f3a408", "relationship--63143d60-ecbe-4d5b-b181-70f714f60866", "attack-pattern--00d46220-650f-446e-888c-28c5b6e7246a", "relationship--ae3751f1-82fb-4f19-80d0-c0fa6f2c5a2e", "relationship--e7a63adf-19ad-44dd-b8f2-c9340e99f9d8", "attack-pattern--6b6a60ce-8252-415c-a41f-0e9498b1eb21", "relationship--7b16d653-1af0-4723-9153-84346f76fef5", "relationship--20c06da1-9e4a-4a94-b7f7-94291f3e1786", "attack-pattern--bb7fb086-2db0-4109-ae4f-b66b7981cd94", "relationship--0458d1c5-906e-4790-a3d3-cf755decd591", "relationship--04ef95e1-8127-4de9-8352-780aa64b8c7e", "attack-pattern--722e1b6f-7f55-4582-b334-447990149568", "relationship--16353b26-4a77-42d6-8fd5-c227edfd6999", "relationship--57491d05-794b-4da7-880f-74391a0a5c2f", "attack-pattern--19ac6aac-7739-4a02-a153-f458527138a1", "relationship--608a9331-945f-472d-b82f-dfcd9e300022", "relationship--f3c7c7a5-81c0-49c3-bc1d-896fde73921f", "relationship--687174a5-1921-4483-8e1e-99c024d34fe5", "relationship--63c8e6c1-d6cc-4a19-a594-1cc8b0917912", "relationship--73c0cc79-7aa6-48d9-a736-491f2a7d389d", "relationship--c19da6d8-2735-40ee-a451-02c864830476", "relationship--a0a0b9bb-a1a4-4f05-8203-b3d9e363e19e", "relationship--7c8f84be-c115-4d83-854e-f3e04d406dcd", "relationship--398c7f61-b6d8-497a-9ce2-3a0980f7824a", "relationship--ce56ef7b-a93c-4b26-a073-f5346799332e", "relationship--46d21346-9302-4e49-856b-3e38d614a1c4", "relationship--a5053201-d73a-4372-83c0-31cc95b3170e", "relationship--fca6d808-31c4-49ef-8fc4-4b8dfbcf940b", "relationship--4dbcb6d5-1691-4c14-9518-aa7abd6d4cdf", "relationship--7d6f935a-dc3f-4cf2-b7c1-e6fe23ef4acc", "relationship--46962eba-bf01-4bc3-9aba-7be842549a88", "relationship--6e87f0ee-6551-4d76-a09e-1b55841ee192", "relationship--c7df7c18-2315-451c-8f3a-ecc019ebb24c", "relationship--a4d8197d-63e3-4dcf-8f5c-30c5f42964f0", "relationship--83815d8f-094d-4a80-83c2-c847b2998aa5", "relationship--c47a6612-ccd5-42d9-86ba-2dc7d51e18b4", "relationship--1bc83535-cd81-4ca1-a3a7-cc5400b09dc2", "relationship--70de279d-8638-4c5c-b861-7a8f81e6e53f", "relationship--9397b364-9c7d-4de2-8c56-1c575a1bd1c5", "relationship--6bdf477f-5b8d-4e44-910e-64e6e9a21721", "relationship--c810ce19-34a4-43d1-b275-50074aa6406b", "indicator--9a701cb2-e67e-43e4-b921-0c467b913617", "relationship--96333f43-c1ce-4405-b79f-163019aa5f6d", "indicator--698c7a42-ded2-480d-a138-d3c959f40a49", "relationship--d17dbaf7-9d21-4817-88d7-32fc5f694813", "indicator--dddf3c3b-2be0-4ca9-9084-eb388811ff59", "relationship--5c10646c-8667-4ccb-adf4-9e77077814bb", "indicator--585a5363-b310-4237-a6b3-8cb2aaa77b08", "relationship--fd56ed7a-b6b4-4a40-8e6e-a48d2b3136ca", "indicator--f3f67205-8b26-4091-8822-f35cafc027e9", "relationship--00bc634d-df62-4cbb-9a9f-38eaa05099e3", "indicator--c7489ade-b373-465f-896f-43431c725090", "relationship--1ab506d6-0d95-4ce4-b411-1e1996e16a02", "indicator--4a7e6b04-409b-48b7-b60b-117700278e90", "relationship--f93deb56-52c6-4349-ab4f-77348574270a", "indicator--fd1ccbde-2620-41e7-b066-6b9960de3698", "relationship--a3e3412e-c4dc-40ce-aa41-93721bf5d35c", "indicator--0e9cea64-ac6e-42d3-81e3-2120d79e9813", "relationship--c0b7e4b0-3760-40cf-99ab-34f4cfce7c15", "indicator--c2f04d4c-e200-4153-8700-febf15d36c5e", "relationship--9c6c347f-5f68-4c0d-b58c-bebd0024d193", "indicator--8e88a48f-cadf-443b-8994-fc321dbffefd", "relationship--1fb96d54-1d83-4abc-b607-c259a656fd4e", "indicator--a0d92396-35e9-4500-99c8-27f128239684", "relationship--9b74b52a-7441-4a57-af62-dae9931e6b99", "indicator--1f377bb7-de3f-4153-af8d-d278f5d604aa", "relationship--1316fd48-a661-4d34-962b-d51c8a11d389", "relationship--529be58f-2e13-4a38-a3d3-baadbddcb1e3", "relationship--a535e28e-b29c-443f-8737-5a1f9203de31", "relationship--bffa2f46-2b50-4894-97d2-ae66d634a63c", "relationship--50be3844-4696-4745-bdba-42a1d32053ea", "relationship--a338f6d9-7df4-49d3-9a5d-3e5af732f47f", "relationship--c2ff0842-c3df-45b7-ae23-3d389dfa7709", "indicator--4babd01b-4051-410a-a0bd-90265efb06c6", "relationship--014f799e-36ae-4840-bae7-249afa15fa07", "relationship--e3602090-f16e-47de-8425-dc830cc79cc8", "relationship--eae5da19-bf14-405c-9c32-257cd042f49d", "relationship--f3f99cc5-4acf-4721-9109-92d1e6309a25", "relationship--70b8fd14-3577-4efe-b00e-48b8ad0fc6f9", "relationship--3304d16d-c41c-4a27-a3b3-1273abf94119", "relationship--a094a78a-a5f7-4c4d-8664-575f638a97b6", "indicator--d61d9b01-1d74-42ad-9564-e50d46ebf743", "relationship--6b7b0161-0623-4f02-ba5c-77a91c3ab411", "relationship--af93df6c-cb69-467f-87b0-e9b2ac837fda", "relationship--f83f2f25-149f-4785-a50f-8924251c0fe7", "relationship--939fec04-6acc-4f05-96a6-d0f952947654", "relationship--0e28cd25-7ab1-41de-91a5-ceec105ac768", "relationship--03007452-493a-4d89-a8c9-f2ba8df0fbe1", "relationship--efc6cd7a-fcb5-49d5-8b8f-0cf6b7d9e1d7", "relationship--7578738a-5b2b-423d-b4f0-a44c747b597c", "relationship--8bbcd2fe-109d-41c7-a8d4-c750a6de8a5b", "relationship--b70d206d-324a-4773-b0b2-a9aad026c9b6", "relationship--8bc9a81a-0f9c-4321-bbaa-a56eb6820389", "relationship--751498d8-f03c-438d-abda-9ae0763217ac", "relationship--5e54bd63-ee30-4965-a924-3fd79bc6fd0d", "indicator--8b4dc4ea-c946-4787-b9be-769cd713f5f6", "relationship--e804f952-1790-461f-9b21-a2abacc70b66", "relationship--d6f41892-81c3-4b80-bda4-e5d7fe00e95d", "relationship--fc21090d-aa56-47b8-b93d-fd29ed684e99", "relationship--bf1455c9-9a3f-4db0-b783-2a16b059e1c0", "relationship--19fbf76b-8fb2-4396-9c58-f915b6eff753", "relationship--744820af-f72e-4990-a447-f7b31b7b4346", "relationship--4a9632bc-499f-495a-b656-21bc33b1d72e", "indicator--33325033-d063-4ec3-8522-7ec9c53c5b55", "relationship--e529024a-0fa2-47d8-8d65-65673fa64726", "relationship--24f48b70-b317-49ea-8975-a4bc5472b215", "relationship--d2b321f4-ec21-42f2-953d-7537a314265d", "relationship--d53d39d2-a0d0-473d-bdf5-05209863897a", "relationship--fc026e4d-1ee4-4e90-bb4e-87b201ef2ae2", "relationship--2caecde6-0017-42bb-8e6c-3ecd6f212260", "relationship--8e406c3d-03eb-43c4-a838-73de8c34cd52", "indicator--41f9f438-32f7-4404-84d3-c1718c619291", "relationship--64b51ad6-d35a-4128-859d-10231b03b2b1", "relationship--5d610242-883d-4de5-9133-fe1ff2162533", "relationship--a9914b36-1049-431e-bd73-f797a3c65efd", "relationship--d0e7d59f-9b38-40ad-8780-e779be5ba8da", "relationship--a3272384-7423-439e-9afb-ecc150ed2d92", "relationship--d44eec23-1535-47be-b4ce-06e38c6d4f4e", "relationship--bea75cab-7e0e-4126-8621-54a90fed24c6", "indicator--69a1a245-2c85-47e3-8e38-ee37e466a329", "relationship--fb233833-8497-408b-95c0-db2504794bab", "relationship--824bfd3b-8647-4deb-bd0b-4cb095c3d262", "relationship--ddce2118-19d2-40ff-a328-2f8c4f5a7b81", "relationship--dac2b7d9-33c4-476c-802a-b6e79067fc70", "relationship--f3ea62f0-9c14-46fa-975a-b5148b4bccd0", "relationship--d38f6b79-021b-4b17-a49c-79bd45b724a3", "relationship--f87f1405-4890-4bb2-918a-ad7800be5e25", "indicator--7fd02483-ee1b-46b4-a864-a7b9dd81fd56", "relationship--25b0c529-91f8-405d-a066-f507045490a8", "relationship--1c9ba4ef-c124-4336-b332-c8ed8d08268d", "relationship--1ecf732b-1df3-46fd-a635-a717ce86253d", "relationship--64822b7b-a932-45d8-903b-76026df3272a", "relationship--6d7f4113-aee0-4668-b0dd-723ab16518ae", "relationship--63f6c126-d523-4db3-b1de-7953976d3cf8", "relationship--6cb5878a-878e-4caf-a76f-215ceb7e7631", "indicator--0071baa3-22e7-4ba9-a3c7-ae7e5e6976f4", "relationship--3e172c35-b38d-4b86-ba7f-27f04ef95b6b", "relationship--da5660dc-917d-4089-839a-fb5b3ca6315a", "relationship--f5a67042-29b8-4614-bb68-71ce41d9abc6", "relationship--c61d6c60-6a6f-4a58-8091-262049430f15", "relationship--5b75d23f-8a3f-4e03-9539-28e867a21059", "relationship--0dc6146c-9975-4a34-84ce-9fc57b91e674", "relationship--9a05f14d-18a7-4020-a4dc-6fa394e07cd4", "indicator--87d9941f-00bc-4445-a839-4ac055628457", "relationship--b51b3c21-0741-4cb0-acd2-221f09732d7d", "relationship--74de5300-b40e-4a1d-9540-bde45e59a843", "relationship--283c2216-d15e-4899-aa90-2656cfebf68f", "relationship--3df0a83c-ddf3-4f27-878e-89f84db1997d", "relationship--025d9af2-d398-4be2-815f-d358525db099", "relationship--50c8223e-16b0-4ee4-8805-fc775714629e", "relationship--7459874f-1195-44a6-a9c7-1b09eb244a3c", "indicator--7372208e-6c26-4644-8199-845256ea47c2", "relationship--4061bf0d-ad48-4b06-8316-44878e2376b4", "relationship--879c9341-3f90-4ace-bd2f-0a1eb3845d6b", "relationship--0121bc97-a4ba-4936-ba42-2884b87d8ec6", "relationship--ee19960e-e224-47b4-9c46-a11915944332", "relationship--e2058d5e-dac1-4590-8131-bfb4b26fd180", "indicator--89e5d2fc-566b-4225-a5ad-910d6eacbd71", "relationship--96c4d5d7-be81-4be0-ae67-e1eadf6a25f1", "relationship--b3c6c56f-71be-41e0-afd3-5f3a411fb216", "relationship--f936b722-c6a9-46e1-b100-67df1de394c2", "relationship--fbc50fee-b532-4dd7-b35c-aa1675509381", "relationship--5127455f-bea2-4301-96bd-db18d57f6b05", "indicator--e4316d33-31ef-427f-9c6f-aab2cb90e7b2", "relationship--a7423810-d94b-4fc3-96ef-fd6f10de7bff", "relationship--38e8779f-22b2-44c1-b986-8883d6eac030", "relationship--f3e83f4d-0511-4351-bc74-41215bdd0a3b", "relationship--bd5cd30d-f417-44f0-834d-4ea89df3bf59", "relationship--271a85e8-42dd-4823-8bcf-5a92b2388015", "indicator--4ff81de4-fcc6-4529-8b8c-d8e6dc6f5ffe", "relationship--4b4cd6ed-e2a4-4654-bd3e-32e8f229fb86", "relationship--63a6bd13-542d-442f-88cb-19f47d6fb069", "relationship--f841b8b7-afc5-4104-b681-0867b964b62c", "relationship--3807fdb0-3676-4d56-b8d8-8fe70d225c7c", "relationship--4406ced4-a986-434f-b63f-279373d5d5c5", "indicator--27ae4c68-5630-4912-917b-b4bf4e34bf5b", "relationship--e69efa81-8acc-4ed9-940d-a0cb9cd80b14", "relationship--9e26699f-13c6-4268-97dd-6cac3caeff7a", "relationship--f174c493-76bc-4448-8b38-564262f28ff3", "relationship--91f8d00a-a2ae-4ff1-b20c-1d2a04df65c7", "relationship--7e2fe91c-b717-49e4-818b-40307d802d10", "indicator--bde80829-6ced-4e61-a14a-161cf6ddfac3", "relationship--2b3c1be4-660e-405a-bc9f-c2c583e62273", "relationship--5b291124-da75-43e5-b7f3-1fabdc9306da", "relationship--16391d1b-0870-4294-8c60-4e9bb8322e23", "relationship--bb2a38fd-7f86-415f-abc6-7f6c255c4bc7", "relationship--65aaf30c-220f-434b-bccc-0f0d3f6c4059", "indicator--f1fc11c0-27a6-4206-9b05-881b74ba99d4", "relationship--e68e6250-b6cb-4de7-a05d-befe7af29f30", "relationship--1a7099b9-700c-407d-87c4-a0fab5fb86c2", "relationship--1a7fdbc1-2dc6-49b2-9598-8ad6c56052d8", "relationship--4781e45c-2072-4d17-b8ee-896783ea8614", "relationship--e2409c51-1bfb-4d23-b909-8f211cd78f2e", "indicator--51a70813-13ee-4cdc-bb5d-3e1a8e5f9507", "relationship--9044f9d8-b8ce-4bf2-952f-042b6a83cea3", "relationship--1db98b95-f8e3-43ca-89ac-0619aec613e6", "relationship--29e9b8d8-b73b-4601-95c7-a069f227694d", "relationship--f705bbb5-e0e8-4af5-a96f-af2a92c679f2", "relationship--08cfa698-d0ef-4237-be7f-294f01aa71c2", "indicator--f364e845-7345-4331-9ca2-91302806270a", "relationship--56fa1cef-1e32-4183-bf86-be1cfd40ad35", "relationship--b44b8cbd-c97c-4bc7-adbf-f61104c9074b", "relationship--58a7e1a1-86f7-4366-96c5-7c60c6b1bc85", "relationship--58f0defd-652a-4ad4-881d-d2097eea63f3", "relationship--6d21c7cc-d0a5-44ba-ace6-db9491923227", "indicator--4ab59326-c540-4996-a57c-466fa7646a71", "relationship--078e34b5-b7a3-498d-90df-32f7e57af5df", "relationship--853d1143-3fa2-4d9c-9d26-4f5232b83fdd", "relationship--e587df29-b3e7-48ef-b72d-effd69ab8cb9", "relationship--333846a8-d7d1-4ca6-bfb8-07ceda1d4797", "relationship--a321c8c7-3fa9-4f92-b0c1-1a45ee2ae3af", "indicator--a4d734fb-01db-4b6d-b6aa-b9ed01d78ee4", "relationship--d6119eae-94af-4b70-a154-e2e9676e0982", "relationship--b9b62e25-7f82-4e05-9eb7-02b6e3a83862", "relationship--f0290411-6f27-4093-86c9-53a4da574886", "relationship--1156b8b8-88d6-4584-a6dc-f9b4fda68ee3", "relationship--ee639674-3a12-48e3-8a2b-5144a56636c2", "indicator--3670ba95-52f2-4532-bbf5-ae34c9e1e28c", "relationship--1a84095b-73e3-4d0e-bd20-f227d0d1686f", "relationship--e2b43054-4b3c-46c2-8315-488c5a402db5", "relationship--55fcbff6-85ed-460d-a6b7-af0136d5fd80", "relationship--1b5f0be2-312c-46a4-a2e0-386636689c54", "relationship--4ff38a3e-8b8d-46d9-9080-be1541d9069e", "indicator--8c2b7294-5bdb-40e0-9dbd-c88a428941aa", "relationship--e29b772b-0caa-4017-b27a-6a46b6ea486a", "relationship--5b62fd7a-059c-4972-872d-fefefb2733a4", "relationship--f6bcea10-2c57-4c0a-97a2-c8b15b0a2ca0", "relationship--dc5bf4bd-d416-4ae4-9f46-8c090811feec", "relationship--fed10efa-800d-409a-8a4b-b6a24c44fbad", "indicator--cdfbfcf0-ad90-4fb6-b8af-0f34460d8e4b", "relationship--1df10e08-af26-4a21-9070-5ded06424ec4", "relationship--99f2f83f-46e6-4475-aa72-b1cf359034f2", "relationship--4d7e84f0-5394-4d42-8d27-b5f8482a0912", "relationship--3a9e88a0-bad8-424c-b6e1-28c00b8c3b1c", "relationship--4a5a70ed-93e1-478e-8bbf-fff1519c9140", "indicator--84f744ff-5a06-419e-9729-48fefc9a59b8", "relationship--65886c82-332a-4e65-9b8c-1b7a289bf05f", "relationship--a564b3c4-5cad-43f7-ae81-5eb866d08a23", "relationship--e69c6b69-b4ff-4cc9-bb49-aa5347942519", "relationship--a64c99b2-570b-49a9-834f-87f2e1fff52a", "relationship--ed68f857-f0eb-4807-bcc1-81fbf359e7db", "indicator--f0becbcf-0c17-477b-9c76-44ec72555441", "relationship--7dad327e-ba14-4371-acc4-7f4926d57eac", "relationship--7d4809ef-1957-4ab2-b16e-f13c29102498", "relationship--0929bd15-3009-4e01-a223-3e8419a23669", "relationship--a199b570-84d5-46fc-9c8a-cf4459e5704f", "relationship--a6005a4e-da7f-4a80-81cc-9b0a3439c666", "indicator--0f227c98-74ee-44da-999a-f6bb95fa12a5", "relationship--d63513dd-2f21-4c61-9b22-ea3b2bd93e18", "relationship--66c5bef1-65b3-4b2f-bc2f-0f6820a456ff", "relationship--0c5562ac-bdce-43a6-868d-ff4ead680024", "relationship--5cb9d5db-7e53-4bb3-991a-9b152a97841e", "relationship--5eeeaaeb-426b-4f46-9c6e-0231981f1cb1", "indicator--ce5b10d8-2727-4d33-a005-1e16ca1abfdf", "relationship--db36afe9-8bac-4aec-9f49-ee7862105dc1", "relationship--2251638e-b227-48a9-a92a-b377c6b217de", "relationship--33cf9fbf-1c56-4ed3-b785-457b7b91731c", "relationship--c0f00137-3ef3-4ed2-a7b7-c2e555613903", "relationship--6becc8b6-77f9-437a-808d-ee65af088215", "indicator--7bac2a19-2b9d-43c3-8499-625fd223b393", "relationship--63171591-e4e5-4c6b-a32a-7886d4e4b526", "relationship--28fb913b-6446-456f-9109-44f71f7bb4b5", "relationship--ae47ea75-4ce3-4839-ae67-8a580195fad0", "relationship--f5e166e6-02e5-4d5c-b167-f1baab2c76dd", "relationship--b05662f8-cd01-44a7-bef7-6a2eda2a8a7b", "indicator--42e5f74d-58b0-4084-bfe7-967dd5850834", "relationship--c2cb43d6-e5cb-41f3-a3fa-cffabbb05f6b", "relationship--21eaff68-a965-46d2-8482-5ca8fef24ea6", "relationship--a22d6696-0c0a-4254-acce-87dde18f6736", "relationship--9c43cc75-93a8-48ec-b531-93d9307d12c7", "relationship--3eef8b12-83db-4233-a0a9-1328ddb47a3f", "indicator--5f531571-2a61-4697-9cdd-af4478f5ee60", "relationship--6ccbdcd1-4306-4879-b25e-7b93519a2592", "relationship--a0370934-1155-4cb7-b335-3d0fe28e2325", "relationship--78a08339-9184-48ec-9778-628c8260a741", "relationship--eacd686c-c347-4dbc-b36e-0524c4129820", "relationship--6f12cb8a-6d56-4b31-bba5-7d3381428490", "indicator--176a8872-1468-4459-ab49-0ba6d815a0e4", "relationship--d81f6e63-979a-4b82-8d99-e66dc80f3576", "relationship--557f9057-6b69-45c6-954e-57abc97b1391", "relationship--7042bd96-51c8-4ae4-afe9-30e4bdfb954d", "relationship--e02fd82c-2a92-429f-b555-ccdb459d0c31", "relationship--8429e02d-e54e-42a8-b5c9-b2c10ffb3d00", "indicator--96ca2c87-c2b0-42c6-aa13-fa1c6d208a27", "relationship--745eb2f7-cdbb-4652-961b-25e39fcd4631", "relationship--a3127223-ade2-4c6c-8720-c573d255d452", "relationship--b5d8983b-b7f2-4322-832c-6d4b22e6caf1", "relationship--aa22f1b4-7741-4568-bef3-79e15bf3fb13", "relationship--c0fcbbe4-3f07-4e11-a63a-437e4f2d6c9e", "indicator--dcff5e4d-f55c-4ce3-8d63-6c93e6343c46", "relationship--f4aaa21d-cbc1-4d7c-a895-c15c0e7a7ff9", "relationship--4ce02aa7-2338-4d38-877e-7995660a13c8", "relationship--dbe14510-7952-4839-9cdd-9b880083b76a", "relationship--d6a3fee1-8f62-451e-b71e-c63709785150", "relationship--cd5c7da7-be37-425b-a6d6-b98546eb9175", "indicator--89f43085-f61e-4d55-88c5-b52cfd091315", "relationship--0dcd9ada-99de-4e29-8052-09fc76ceaaed", "relationship--a211b3b7-2938-4add-a249-94906952c7dc", "relationship--ea0575fc-f08b-491a-beb0-0dbb8bdc1809", "relationship--cf7e2a94-8110-4421-8169-ffec56ebd0a0", "relationship--d5bbb803-d4ce-4dc9-8151-c5db5f10c697", "indicator--5dd168a2-07af-438c-bc9c-9382cada1345", "relationship--2e96a86d-dc9a-49c8-90ef-a6c47f3220cd", "relationship--f8d29445-9318-4f68-b176-302d65517e4f", "relationship--5e9ab86d-11be-4f1a-96a3-8a0703263614", "relationship--6ec84e5b-2e99-42a0-b52d-de399792f240", "relationship--b73cb231-d1c5-4355-ba85-6dcba1d37704", "relationship--016969c4-3bc9-4a59-84c5-ebde23ef8f75", "relationship--4ed08512-e613-4347-8994-ac3df941ce16", "indicator--c07d0ce5-e96e-463d-8259-7632d33db5e3", "relationship--456127c2-8507-45a3-b750-f490655e2493", "relationship--6e0f1248-770b-4875-8350-6f7223a6bc1a", "relationship--eef155c0-2552-4bf3-9fc8-2ed09144cf13", "relationship--07aa7b14-a0cc-4447-8fe8-975d423052dd", "relationship--36f18ee3-ad11-40d4-8933-332a8b08abaa", "relationship--465d1030-695f-4648-81e0-525ecd401d7a", "relationship--a8ea5e93-f4da-4ac3-98ca-ecf2a0900f3b" ], "x_version": "1.0" } ] }