http://git-wip-us.apache.org/repos/asf/metron/blob/df94ed40/metron-platform/metron-data-management/src/test/resources/taxii-messages/messages.poll ---------------------------------------------------------------------- diff --git a/metron-platform/metron-data-management/src/test/resources/taxii-messages/messages.poll b/metron-platform/metron-data-management/src/test/resources/taxii-messages/messages.poll index 1c9d529..3408dc5 100644 --- a/metron-platform/metron-data-management/src/test/resources/taxii-messages/messages.poll +++ b/metron-platform/metron-data-management/src/test/resources/taxii-messages/messages.poll @@ -419,2495 +419,6 @@ </stix:Observables> </stix:STIX_Package> </taxii_11:Content> - <taxii_11:Timestamp_Label>2016-02-22T15:24:02.972941Z</taxii_11:Timestamp_Label> - </taxii_11:Content_Block> - <taxii_11:Content_Block> - <taxii_11:Content_Binding binding_id="urn:stix.mitre.org:xml:1.1.1"/> - <taxii_11:Content> - <stix:STIX_Package id="edge:Package-c5daa87d-9dbe-4cbe-b18b-2d01589c1f55" timestamp="2016-02-22T15:24:02.973486+00:00" version="1.1.1" xmlns:stixCommon="http://stix.mitre.org/common-1"; xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"; xmlns:simpleMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1"; xmlns:edge="http://soltra.com/"; xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"; xmlns:opensource="http://hailataxii.com"; xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"; xmlns:ttp="http://stix.mitre.org/TTP-1"; xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1"; xmlns:TOUMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1"; xmlns:stix="http://stix.mitre.org/stix-1"; xmlns:marking="http://data-marking.mitre.org/Marking-1"; xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1"; xmlns:cyboxCommon="http://cybox.mitre.org/common-2"; xmlns:cybox="h ttp://cybox.mitre.org/cybox-2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";> - <stix:STIX_Header> - <stix:Handling> - <marking:Marking> - <marking:Controlled_Structure>../../../../descendant-or-self::node()</marking:Controlled_Structure> - <marking:Marking_Structure color="WHITE" xsi:type="tlpMarking:TLPMarkingStructureType"/> - <marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType"> - <TOUMarking:Terms_Of_Use>zeustracker.abuse.ch | Abuse source[https://sslbl.abuse.ch/blacklist/] - As for all abuse.ch projects, the use of the SSL Blacklist is free for both commercial and non-commercial usage without any limitation. However, if you are a commercial vendor of security software/services and you want to integrate data from the SSL Blacklist into your products / services, you will have to ask for permission first by contacting me using the contact form [http://www.abuse.ch/?page_id=4727].' -</TOUMarking:Terms_Of_Use> - </marking:Marking_Structure> - <marking:Marking_Structure xsi:type="simpleMarking:SimpleMarkingStructureType"> - <simpleMarking:Statement>Unclassified (Public)</simpleMarking:Statement> - </marking:Marking_Structure> - </marking:Marking> - </stix:Handling> - </stix:STIX_Header> - <stix:TTPs> - <stix:TTP id="opensource:ttp-08b96668-60fe-4a85-b28e-31fc9fe917c2" timestamp="2014-10-31T16:44:24.724411+00:00" version="1.1.1" xsi:type="ttp:TTPType"> - <ttp:Title>ZeuS</ttp:Title> - <ttp:Behavior> - <ttp:Malware> - <ttp:Malware_Instance id="opensource:malware-c3b59946-8e31-4f50-bbd9-132d418ecb7a"> - <ttp:Type xsi:type="stixVocabs:MalwareTypeVocab-1.0">Remote Access Trojan</ttp:Type> - <ttp:Name>ZeuS</ttp:Name> - <ttp:Name>Zbot</ttp:Name> - <ttp:Name>Zeus</ttp:Name> - <ttp:Description>Zeus, ZeuS, or Zbot is Trojan horse computer malware that runs on computers running under versions of the Microsoft Windows operating system. While it is capable of being used to carry out many malicious and criminal tasks, it is often used to steal banking information by man-in-the-browser keystroke logging and form grabbing. It is also used to install the CryptoLocker ransomware.[1] Zeus is spread mainly through drive-by downloads and phishing schemes. (2014(http://en.wikipedia.org/wiki/Zeus_%28Trojan_horse%29))</ttp:Description> - <ttp:Short_Description>Zeus, ZeuS, or Zbot is Trojan horse computer malware effects Microsoft Windows operating system</ttp:Short_Description> - </ttp:Malware_Instance> - </ttp:Malware> - </ttp:Behavior> - </stix:TTP> - </stix:TTPs> -</stix:STIX_Package> - </taxii_11:Content> - <taxii_11:Timestamp_Label>2016-02-22T15:24:02.974363Z</taxii_11:Timestamp_Label> - </taxii_11:Content_Block> - <taxii_11:Content_Block> - <taxii_11:Content_Binding binding_id="urn:stix.mitre.org:xml:1.1.1"/> - <taxii_11:Content> - <stix:STIX_Package id="edge:Package-926c768a-4e31-43cd-9390-37229e3fa2f7" timestamp="2016-02-22T15:24:02.974720+00:00" version="1.1.1" xmlns:stixCommon="http://stix.mitre.org/common-1"; xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"; xmlns:indicator="http://stix.mitre.org/Indicator-2"; xmlns:simpleMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1"; xmlns:edge="http://soltra.com/"; xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"; xmlns:opensource="http://hailataxii.com"; xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"; xmlns:ttp="http://stix.mitre.org/TTP-1"; xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1"; xmlns:TOUMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1"; xmlns:stix="http://stix.mitre.org/stix-1"; xmlns:marking="http://data-marking.mitre.org/Marking-1"; xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1"; xmlns:cyboxCom mon="http://cybox.mitre.org/common-2"; xmlns:cybox="http://cybox.mitre.org/cybox-2"; xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";> - <stix:STIX_Header> - <stix:Handling> - <marking:Marking> - <marking:Controlled_Structure>../../../../descendant-or-self::node()</marking:Controlled_Structure> - <marking:Marking_Structure color="WHITE" xsi:type="tlpMarking:TLPMarkingStructureType"/> - <marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType"> - <TOUMarking:Terms_Of_Use>zeustracker.abuse.ch | Abuse source[https://sslbl.abuse.ch/blacklist/] - As for all abuse.ch projects, the use of the SSL Blacklist is free for both commercial and non-commercial usage without any limitation. However, if you are a commercial vendor of security software/services and you want to integrate data from the SSL Blacklist into your products / services, you will have to ask for permission first by contacting me using the contact form [http://www.abuse.ch/?page_id=4727].' -</TOUMarking:Terms_Of_Use> - </marking:Marking_Structure> - <marking:Marking_Structure xsi:type="simpleMarking:SimpleMarkingStructureType"> - <simpleMarking:Statement>Unclassified (Public)</simpleMarking:Statement> - </marking:Marking_Structure> - </marking:Marking> - </stix:Handling> - </stix:STIX_Header> - <stix:Indicators> - <stix:Indicator id="opensource:indicator-f93507d6-dad1-4299-8617-dff154b5ac62" timestamp="2014-10-31T16:44:24.911510+00:00" version="2.1.1" xsi:type="indicator:IndicatorType"> - <indicator:Title>ZeuS Tracker (online)| krlsma.com/wp-includes/Text/dom/php/file.php (2014-10-15) | This domain has been identified as malicious by zeustracker.abuse.ch</indicator:Title> - <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> - <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type> - <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> - <indicator:Description>This domain krlsma.com has been identified as malicious by zeustracker.abuse.ch. For more detailed infomation about this indicator go to [CAUTION!!Read-URL-Before-Click] [https://zeustracker.abuse.ch/monitor.php?host=krlsma.com].</indicator:Description> - <indicator:Observable idref="opensource:Observable-24efd7b7-3474-4b22-8ad7-285f298dad41"> - </indicator:Observable> - <indicator:Indicated_TTP> - <stixCommon:TTP idref="opensource:ttp-8f601fc3-bd6d-4c4e-94c9-b5dbad93ed0b" xsi:type="ttp:TTPType"/> - </indicator:Indicated_TTP> - <indicator:Producer> - <stixCommon:Identity id="opensource:Identity-740330e4-9f30-4710-9336-ff9d71492984"> - <stixCommon:Name>zeustracker.abuse.ch</stixCommon:Name> - </stixCommon:Identity> - <stixCommon:Time> - <cyboxCommon:Produced_Time>2014-10-15T00:00:00+00:00</cyboxCommon:Produced_Time> - <cyboxCommon:Received_Time>2014-10-20T19:29:30+00:00</cyboxCommon:Received_Time> - </stixCommon:Time> - </indicator:Producer> - </stix:Indicator> - </stix:Indicators> -</stix:STIX_Package> - </taxii_11:Content> - <taxii_11:Timestamp_Label>2016-02-22T15:24:02.975911Z</taxii_11:Timestamp_Label> - </taxii_11:Content_Block> - <taxii_11:Content_Block> - <taxii_11:Content_Binding binding_id="urn:stix.mitre.org:xml:1.1.1"/> - <taxii_11:Content> - <stix:STIX_Package id="edge:Package-6225344f-12c1-49f8-b6e2-862d804044b1" timestamp="2016-02-22T15:24:02.976445+00:00" version="1.1.1" xmlns:stixCommon="http://stix.mitre.org/common-1"; xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"; xmlns:simpleMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1"; xmlns:edge="http://soltra.com/"; xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"; xmlns:opensource="http://hailataxii.com"; xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"; xmlns:ttp="http://stix.mitre.org/TTP-1"; xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1"; xmlns:TOUMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1"; xmlns:stix="http://stix.mitre.org/stix-1"; xmlns:marking="http://data-marking.mitre.org/Marking-1"; xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1"; xmlns:cyboxCommon="http://cybox.mitre.org/common-2"; xmlns:cybox="h ttp://cybox.mitre.org/cybox-2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";> - <stix:STIX_Header> - <stix:Handling> - <marking:Marking> - <marking:Controlled_Structure>../../../../descendant-or-self::node()</marking:Controlled_Structure> - <marking:Marking_Structure color="WHITE" xsi:type="tlpMarking:TLPMarkingStructureType"/> - <marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType"> - <TOUMarking:Terms_Of_Use>zeustracker.abuse.ch | Abuse source[https://sslbl.abuse.ch/blacklist/] - As for all abuse.ch projects, the use of the SSL Blacklist is free for both commercial and non-commercial usage without any limitation. However, if you are a commercial vendor of security software/services and you want to integrate data from the SSL Blacklist into your products / services, you will have to ask for permission first by contacting me using the contact form [http://www.abuse.ch/?page_id=4727].' -</TOUMarking:Terms_Of_Use> - </marking:Marking_Structure> - <marking:Marking_Structure xsi:type="simpleMarking:SimpleMarkingStructureType"> - <simpleMarking:Statement>Unclassified (Public)</simpleMarking:Statement> - </marking:Marking_Structure> - </marking:Marking> - </stix:Handling> - </stix:STIX_Header> - <stix:TTPs> - <stix:TTP id="opensource:ttp-8f601fc3-bd6d-4c4e-94c9-b5dbad93ed0b" timestamp="2014-10-31T16:44:24.912948+00:00" version="1.1.1" xsi:type="ttp:TTPType"> - <ttp:Title>ZeuS</ttp:Title> - <ttp:Behavior> - <ttp:Malware> - <ttp:Malware_Instance id="opensource:malware-a908f65f-1a21-4658-b70c-ea1acd6ceca1"> - <ttp:Type xsi:type="stixVocabs:MalwareTypeVocab-1.0">Remote Access Trojan</ttp:Type> - <ttp:Name>ZeuS</ttp:Name> - <ttp:Name>Zbot</ttp:Name> - <ttp:Name>Zeus</ttp:Name> - <ttp:Description>Zeus, ZeuS, or Zbot is Trojan horse computer malware that runs on computers running under versions of the Microsoft Windows operating system. While it is capable of being used to carry out many malicious and criminal tasks, it is often used to steal banking information by man-in-the-browser keystroke logging and form grabbing. It is also used to install the CryptoLocker ransomware.[1] Zeus is spread mainly through drive-by downloads and phishing schemes. (2014(http://en.wikipedia.org/wiki/Zeus_%28Trojan_horse%29))</ttp:Description> - <ttp:Short_Description>Zeus, ZeuS, or Zbot is Trojan horse computer malware effects Microsoft Windows operating system</ttp:Short_Description> - </ttp:Malware_Instance> - </ttp:Malware> - </ttp:Behavior> - </stix:TTP> - </stix:TTPs> -</stix:STIX_Package> - </taxii_11:Content> - <taxii_11:Timestamp_Label>2016-02-22T15:24:02.977154Z</taxii_11:Timestamp_Label> - </taxii_11:Content_Block> - <taxii_11:Content_Block> - <taxii_11:Content_Binding binding_id="urn:stix.mitre.org:xml:1.1.1"/> - <taxii_11:Content> - <stix:STIX_Package id="edge:Package-3d34d4a5-9c0f-4cbb-9751-ced4d77dfc89" timestamp="2016-02-22T15:24:02.977643+00:00" version="1.1.1" xmlns:stixCommon="http://stix.mitre.org/common-1"; xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"; xmlns:simpleMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1"; xmlns:edge="http://soltra.com/"; xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"; xmlns:opensource="http://hailataxii.com"; xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"; xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1"; xmlns:TOUMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1"; xmlns:stix="http://stix.mitre.org/stix-1"; xmlns:marking="http://data-marking.mitre.org/Marking-1"; xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1"; xmlns:cyboxCommon="http://cybox.mitre.org/common-2"; xmlns:cybox="http://cybox.mitre.org/cybox-2"; xmlns:xsi ="http://www.w3.org/2001/XMLSchema-instance";> - <stix:STIX_Header> - <stix:Handling> - <marking:Marking> - <marking:Controlled_Structure>../../../../descendant-or-self::node()</marking:Controlled_Structure> - <marking:Marking_Structure color="WHITE" xsi:type="tlpMarking:TLPMarkingStructureType"/> - <marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType"> - <TOUMarking:Terms_Of_Use>zeustracker.abuse.ch | Abuse source[https://sslbl.abuse.ch/blacklist/] - As for all abuse.ch projects, the use of the SSL Blacklist is free for both commercial and non-commercial usage without any limitation. However, if you are a commercial vendor of security software/services and you want to integrate data from the SSL Blacklist into your products / services, you will have to ask for permission first by contacting me using the contact form [http://www.abuse.ch/?page_id=4727].' -</TOUMarking:Terms_Of_Use> - </marking:Marking_Structure> - <marking:Marking_Structure xsi:type="simpleMarking:SimpleMarkingStructureType"> - <simpleMarking:Statement>Unclassified (Public)</simpleMarking:Statement> - </marking:Marking_Structure> - </marking:Marking> - </stix:Handling> - </stix:STIX_Header> - <stix:Observables cybox_major_version="2" cybox_minor_version="1" cybox_update_version="0"> - <cybox:Observable id="opensource:Observable-24efd7b7-3474-4b22-8ad7-285f298dad41"> - <cybox:Observable_Composition operator="OR"> - <cybox:Observable idref="opensource:Observable-cf7403a3-6c63-49e1-ab97-ed0861f71ba9"> - </cybox:Observable> - <cybox:Observable idref="opensource:Observable-5dade958-25b7-4eec-b3de-c25b580d6d6c"> - </cybox:Observable> - <cybox:Observable idref="opensource:Observable-398c91f0-d12b-499b-844c-67c7a0a9dbe1"> - </cybox:Observable> - </cybox:Observable_Composition> - </cybox:Observable> - </stix:Observables> -</stix:STIX_Package> - </taxii_11:Content> - <taxii_11:Timestamp_Label>2016-02-22T15:24:02.978111Z</taxii_11:Timestamp_Label> - </taxii_11:Content_Block> - <taxii_11:Content_Block> - <taxii_11:Content_Binding binding_id="urn:stix.mitre.org:xml:1.1.1"/> - <taxii_11:Content> - <stix:STIX_Package id="edge:Package-1a737ebf-ee76-4460-9cb2-183577366ab9" timestamp="2016-02-22T15:24:02.978580+00:00" version="1.1.1" xmlns:stixCommon="http://stix.mitre.org/common-1"; xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"; xmlns:simpleMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1"; xmlns:edge="http://soltra.com/"; xmlns:DomainNameObj="http://cybox.mitre.org/objects#DomainNameObject-1"; xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"; xmlns:opensource="http://hailataxii.com"; xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"; xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1"; xmlns:TOUMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1"; xmlns:stix="http://stix.mitre.org/stix-1"; xmlns:marking="http://data-marking.mitre.org/Marking-1"; xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1"; xmlns:cyboxCommon="http://cybox.mi tre.org/common-2" xmlns:cybox="http://cybox.mitre.org/cybox-2"; xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";> - <stix:STIX_Header> - <stix:Handling> - <marking:Marking> - <marking:Controlled_Structure>../../../../descendant-or-self::node()</marking:Controlled_Structure> - <marking:Marking_Structure color="WHITE" xsi:type="tlpMarking:TLPMarkingStructureType"/> - <marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType"> - <TOUMarking:Terms_Of_Use>zeustracker.abuse.ch | Abuse source[https://sslbl.abuse.ch/blacklist/] - As for all abuse.ch projects, the use of the SSL Blacklist is free for both commercial and non-commercial usage without any limitation. However, if you are a commercial vendor of security software/services and you want to integrate data from the SSL Blacklist into your products / services, you will have to ask for permission first by contacting me using the contact form [http://www.abuse.ch/?page_id=4727].' -</TOUMarking:Terms_Of_Use> - </marking:Marking_Structure> - <marking:Marking_Structure xsi:type="simpleMarking:SimpleMarkingStructureType"> - <simpleMarking:Statement>Unclassified (Public)</simpleMarking:Statement> - </marking:Marking_Structure> - </marking:Marking> - </stix:Handling> - </stix:STIX_Header> - <stix:Observables cybox_major_version="2" cybox_minor_version="1" cybox_update_version="0"> - <cybox:Observable id="opensource:Observable-cf7403a3-6c63-49e1-ab97-ed0861f71ba9" sighting_count="1"> - <cybox:Title>Domain: krlsma.com</cybox:Title> - <cybox:Description>Domain: krlsma.com | isFQDN: True | </cybox:Description> - <cybox:Object id="opensource:DomainName-53c73da2-81ef-4242-98b2-1b1215e0f124"> - <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType"> - <DomainNameObj:Value condition="Equals">krlsma.com</DomainNameObj:Value> - </cybox:Properties> - </cybox:Object> - </cybox:Observable> - </stix:Observables> -</stix:STIX_Package> - </taxii_11:Content> - <taxii_11:Timestamp_Label>2016-02-22T15:24:02.979274Z</taxii_11:Timestamp_Label> - </taxii_11:Content_Block> - <taxii_11:Content_Block> - <taxii_11:Content_Binding binding_id="urn:stix.mitre.org:xml:1.1.1"/> - <taxii_11:Content> - <stix:STIX_Package id="edge:Package-8f2994a9-1a61-40fc-be8f-63f7709823d1" timestamp="2016-02-22T15:24:02.979721+00:00" version="1.1.1" xmlns:stixCommon="http://stix.mitre.org/common-1"; xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"; xmlns:simpleMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1"; xmlns:edge="http://soltra.com/"; xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"; xmlns:opensource="http://hailataxii.com"; xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"; xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1"; xmlns:TOUMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1"; xmlns:stix="http://stix.mitre.org/stix-1"; xmlns:marking="http://data-marking.mitre.org/Marking-1"; xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1"; xmlns:cyboxCommon="http://cybox.mitre.org/common-2"; xmlns:URIObj="http://cybox.mitre.org/objects#URIObject -2" xmlns:cybox="http://cybox.mitre.org/cybox-2"; xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";> - <stix:STIX_Header> - <stix:Handling> - <marking:Marking> - <marking:Controlled_Structure>../../../../descendant-or-self::node()</marking:Controlled_Structure> - <marking:Marking_Structure color="WHITE" xsi:type="tlpMarking:TLPMarkingStructureType"/> - <marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType"> - <TOUMarking:Terms_Of_Use>zeustracker.abuse.ch | Abuse source[https://sslbl.abuse.ch/blacklist/] - As for all abuse.ch projects, the use of the SSL Blacklist is free for both commercial and non-commercial usage without any limitation. However, if you are a commercial vendor of security software/services and you want to integrate data from the SSL Blacklist into your products / services, you will have to ask for permission first by contacting me using the contact form [http://www.abuse.ch/?page_id=4727].' -</TOUMarking:Terms_Of_Use> - </marking:Marking_Structure> - <marking:Marking_Structure xsi:type="simpleMarking:SimpleMarkingStructureType"> - <simpleMarking:Statement>Unclassified (Public)</simpleMarking:Statement> - </marking:Marking_Structure> - </marking:Marking> - </stix:Handling> - </stix:STIX_Header> - <stix:Observables cybox_major_version="2" cybox_minor_version="1" cybox_update_version="0"> - <cybox:Observable id="opensource:Observable-5dade958-25b7-4eec-b3de-c25b580d6d6c" sighting_count="1"> - <cybox:Title>URI: http://krlsma.com/wp-includes/Text/dom/php/file.php</cybox:Title> - <cybox:Description>URI: http://krlsma.com/wp-includes/Text/dom/php/file.php | Type: URL | </cybox:Description> - <cybox:Object id="opensource:URI-44fa3e9f-6599-4dda-bbe6-a03b06930084"> - <cybox:Properties type="URL" xsi:type="URIObj:URIObjectType"> - <URIObj:Value condition="Equals">http://krlsma.com/wp-includes/Text/dom/php/file.php</URIObj:Value> - </cybox:Properties> - </cybox:Object> - </cybox:Observable> - </stix:Observables> -</stix:STIX_Package> - </taxii_11:Content> - <taxii_11:Timestamp_Label>2016-02-22T15:24:02.980513Z</taxii_11:Timestamp_Label> - </taxii_11:Content_Block> - <taxii_11:Content_Block> - <taxii_11:Content_Binding binding_id="urn:stix.mitre.org:xml:1.1.1"/> - <taxii_11:Content> - <stix:STIX_Package id="edge:Package-935dbc5c-5eb5-4022-ba49-95d30b845160" timestamp="2016-02-22T15:24:02.981129+00:00" version="1.1.1" xmlns:stixCommon="http://stix.mitre.org/common-1"; xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"; xmlns:simpleMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1"; xmlns:edge="http://soltra.com/"; xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"; xmlns:opensource="http://hailataxii.com"; xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"; xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"; xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1"; xmlns:TOUMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1"; xmlns:stix="http://stix.mitre.org/stix-1"; xmlns:marking="http://data-marking.mitre.org/Marking-1"; xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1"; xmlns:cyboxCommon="http://cybox.mitre.org/comm on-2" xmlns:cybox="http://cybox.mitre.org/cybox-2"; xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";> - <stix:STIX_Header> - <stix:Handling> - <marking:Marking> - <marking:Controlled_Structure>../../../../descendant-or-self::node()</marking:Controlled_Structure> - <marking:Marking_Structure color="WHITE" xsi:type="tlpMarking:TLPMarkingStructureType"/> - <marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType"> - <TOUMarking:Terms_Of_Use>zeustracker.abuse.ch | Abuse source[https://sslbl.abuse.ch/blacklist/] - As for all abuse.ch projects, the use of the SSL Blacklist is free for both commercial and non-commercial usage without any limitation. However, if you are a commercial vendor of security software/services and you want to integrate data from the SSL Blacklist into your products / services, you will have to ask for permission first by contacting me using the contact form [http://www.abuse.ch/?page_id=4727].' -</TOUMarking:Terms_Of_Use> - </marking:Marking_Structure> - <marking:Marking_Structure xsi:type="simpleMarking:SimpleMarkingStructureType"> - <simpleMarking:Statement>Unclassified (Public)</simpleMarking:Statement> - </marking:Marking_Structure> - </marking:Marking> - </stix:Handling> - </stix:STIX_Header> - <stix:Observables cybox_major_version="2" cybox_minor_version="1" cybox_update_version="0"> - <cybox:Observable id="opensource:Observable-398c91f0-d12b-499b-844c-67c7a0a9dbe1" sighting_count="1"> - <cybox:Title>File: file.php</cybox:Title> - <cybox:Description>FileName: file.php | FileHash: cccc3d971cc7f2814229e836076664a1 | </cybox:Description> - <cybox:Object id="opensource:File-eb908acc-cf77-4cd4-9875-eb6408c4c726"> - <cybox:Properties xsi:type="FileObj:FileObjectType"> - <FileObj:File_Name>file.php</FileObj:File_Name> - <FileObj:File_Format>php</FileObj:File_Format> - <FileObj:Hashes> - <cyboxCommon:Hash> - <cyboxCommon:Type xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type> - <cyboxCommon:Simple_Hash_Value condition="Equals">cccc3d971cc7f2814229e836076664a1</cyboxCommon:Simple_Hash_Value> - </cyboxCommon:Hash> - </FileObj:Hashes> - </cybox:Properties> - </cybox:Object> - </cybox:Observable> - </stix:Observables> -</stix:STIX_Package> - </taxii_11:Content> - <taxii_11:Timestamp_Label>2016-02-22T15:24:02.982272Z</taxii_11:Timestamp_Label> - </taxii_11:Content_Block> - <taxii_11:Content_Block> - <taxii_11:Content_Binding binding_id="urn:stix.mitre.org:xml:1.1.1"/> - <taxii_11:Content> - <stix:STIX_Package id="edge:Package-28ffd222-1203-4609-86c3-efa5cfac9b41" timestamp="2016-02-22T15:24:02.982590+00:00" version="1.1.1" xmlns:stixCommon="http://stix.mitre.org/common-1"; xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"; xmlns:indicator="http://stix.mitre.org/Indicator-2"; xmlns:simpleMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1"; xmlns:edge="http://soltra.com/"; xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"; xmlns:opensource="http://hailataxii.com"; xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"; xmlns:ttp="http://stix.mitre.org/TTP-1"; xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1"; xmlns:TOUMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1"; xmlns:stix="http://stix.mitre.org/stix-1"; xmlns:marking="http://data-marking.mitre.org/Marking-1"; xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1"; xmlns:cyboxCom mon="http://cybox.mitre.org/common-2"; xmlns:cybox="http://cybox.mitre.org/cybox-2"; xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";> - <stix:STIX_Header> - <stix:Handling> - <marking:Marking> - <marking:Controlled_Structure>../../../../descendant-or-self::node()</marking:Controlled_Structure> - <marking:Marking_Structure color="WHITE" xsi:type="tlpMarking:TLPMarkingStructureType"/> - <marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType"> - <TOUMarking:Terms_Of_Use>zeustracker.abuse.ch | Abuse source[https://sslbl.abuse.ch/blacklist/] - As for all abuse.ch projects, the use of the SSL Blacklist is free for both commercial and non-commercial usage without any limitation. However, if you are a commercial vendor of security software/services and you want to integrate data from the SSL Blacklist into your products / services, you will have to ask for permission first by contacting me using the contact form [http://www.abuse.ch/?page_id=4727].' -</TOUMarking:Terms_Of_Use> - </marking:Marking_Structure> - <marking:Marking_Structure xsi:type="simpleMarking:SimpleMarkingStructureType"> - <simpleMarking:Statement>Unclassified (Public)</simpleMarking:Statement> - </marking:Marking_Structure> - </marking:Marking> - </stix:Handling> - </stix:STIX_Header> - <stix:Indicators> - <stix:Indicator id="opensource:indicator-0324e19d-9a5a-4cc0-bc74-5a04b6de8bd3" timestamp="2014-10-31T16:44:24.842915+00:00" version="2.1.1" xsi:type="indicator:IndicatorType"> - <indicator:Title>ZeuS Tracker (offline)| goomjav1kaformjavkd.com/neverwind/tmp/pixel.jpg (2014-10-31) | This domain has been identified as malicious by zeustracker.abuse.ch</indicator:Title> - <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> - <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type> - <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> - <indicator:Description>This domain goomjav1kaformjavkd.com has been identified as malicious by zeustracker.abuse.ch. For more detailed infomation about this indicator go to [CAUTION!!Read-URL-Before-Click] [https://zeustracker.abuse.ch/monitor.php?host=goomjav1kaformjavkd.com].</indicator:Description> - <indicator:Observable idref="opensource:Observable-eae86c81-73ec-4ee6-87b6-31a8fa3fe5ac"> - </indicator:Observable> - <indicator:Indicated_TTP> - <stixCommon:TTP idref="opensource:ttp-e6a4b409-9e89-4841-b293-f08483efb12f" xsi:type="ttp:TTPType"/> - </indicator:Indicated_TTP> - <indicator:Producer> - <stixCommon:Identity id="opensource:Identity-3b2e3f22-c0ae-4f57-aac0-f7da7de9d294"> - <stixCommon:Name>zeustracker.abuse.ch</stixCommon:Name> - </stixCommon:Identity> - <stixCommon:Time> - <cyboxCommon:Produced_Time>2014-10-31T00:00:00+00:00</cyboxCommon:Produced_Time> - <cyboxCommon:Received_Time>2014-10-31T16:44:24+00:00</cyboxCommon:Received_Time> - </stixCommon:Time> - </indicator:Producer> - </stix:Indicator> - </stix:Indicators> -</stix:STIX_Package> - </taxii_11:Content> - <taxii_11:Timestamp_Label>2016-02-22T15:24:02.983991Z</taxii_11:Timestamp_Label> - </taxii_11:Content_Block> - <taxii_11:Content_Block> - <taxii_11:Content_Binding binding_id="urn:stix.mitre.org:xml:1.1.1"/> - <taxii_11:Content> - <stix:STIX_Package id="edge:Package-8c7a08a2-8c9d-4761-aebc-0b7a0aac5f68" timestamp="2016-02-22T15:24:02.984608+00:00" version="1.1.1" xmlns:stixCommon="http://stix.mitre.org/common-1"; xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"; xmlns:simpleMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1"; xmlns:edge="http://soltra.com/"; xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"; xmlns:opensource="http://hailataxii.com"; xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"; xmlns:ttp="http://stix.mitre.org/TTP-1"; xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1"; xmlns:TOUMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1"; xmlns:stix="http://stix.mitre.org/stix-1"; xmlns:marking="http://data-marking.mitre.org/Marking-1"; xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1"; xmlns:cyboxCommon="http://cybox.mitre.org/common-2"; xmlns:cybox="h ttp://cybox.mitre.org/cybox-2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";> - <stix:STIX_Header> - <stix:Handling> - <marking:Marking> - <marking:Controlled_Structure>../../../../descendant-or-self::node()</marking:Controlled_Structure> - <marking:Marking_Structure color="WHITE" xsi:type="tlpMarking:TLPMarkingStructureType"/> - <marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType"> - <TOUMarking:Terms_Of_Use>zeustracker.abuse.ch | Abuse source[https://sslbl.abuse.ch/blacklist/] - As for all abuse.ch projects, the use of the SSL Blacklist is free for both commercial and non-commercial usage without any limitation. However, if you are a commercial vendor of security software/services and you want to integrate data from the SSL Blacklist into your products / services, you will have to ask for permission first by contacting me using the contact form [http://www.abuse.ch/?page_id=4727].' -</TOUMarking:Terms_Of_Use> - </marking:Marking_Structure> - <marking:Marking_Structure xsi:type="simpleMarking:SimpleMarkingStructureType"> - <simpleMarking:Statement>Unclassified (Public)</simpleMarking:Statement> - </marking:Marking_Structure> - </marking:Marking> - </stix:Handling> - </stix:STIX_Header> - <stix:TTPs> - <stix:TTP id="opensource:ttp-e6a4b409-9e89-4841-b293-f08483efb12f" timestamp="2014-10-31T16:44:24.843868+00:00" version="1.1.1" xsi:type="ttp:TTPType"> - <ttp:Title>ZeuS</ttp:Title> - <ttp:Behavior> - <ttp:Malware> - <ttp:Malware_Instance id="opensource:malware-d0ef452d-4e25-4770-b560-4e9c01e0de25"> - <ttp:Type xsi:type="stixVocabs:MalwareTypeVocab-1.0">Remote Access Trojan</ttp:Type> - <ttp:Name>ZeuS</ttp:Name> - <ttp:Name>Zbot</ttp:Name> - <ttp:Name>Zeus</ttp:Name> - <ttp:Description>Zeus, ZeuS, or Zbot is Trojan horse computer malware that runs on computers running under versions of the Microsoft Windows operating system. While it is capable of being used to carry out many malicious and criminal tasks, it is often used to steal banking information by man-in-the-browser keystroke logging and form grabbing. It is also used to install the CryptoLocker ransomware.[1] Zeus is spread mainly through drive-by downloads and phishing schemes. (2014(http://en.wikipedia.org/wiki/Zeus_%28Trojan_horse%29))</ttp:Description> - <ttp:Short_Description>Zeus, ZeuS, or Zbot is Trojan horse computer malware effects Microsoft Windows operating system</ttp:Short_Description> - </ttp:Malware_Instance> - </ttp:Malware> - </ttp:Behavior> - </stix:TTP> - </stix:TTPs> -</stix:STIX_Package> - </taxii_11:Content> - <taxii_11:Timestamp_Label>2016-02-22T15:24:02.985825Z</taxii_11:Timestamp_Label> - </taxii_11:Content_Block> - <taxii_11:Content_Block> - <taxii_11:Content_Binding binding_id="urn:stix.mitre.org:xml:1.1.1"/> - <taxii_11:Content> - <stix:STIX_Package id="edge:Package-6042ee98-aa0a-47c0-982c-97fc6c8b65b8" timestamp="2016-02-22T15:24:02.986544+00:00" version="1.1.1" xmlns:stixCommon="http://stix.mitre.org/common-1"; xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"; xmlns:simpleMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1"; xmlns:edge="http://soltra.com/"; xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"; xmlns:opensource="http://hailataxii.com"; xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"; xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1"; xmlns:TOUMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1"; xmlns:stix="http://stix.mitre.org/stix-1"; xmlns:marking="http://data-marking.mitre.org/Marking-1"; xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1"; xmlns:cyboxCommon="http://cybox.mitre.org/common-2"; xmlns:cybox="http://cybox.mitre.org/cybox-2"; xmlns:xsi ="http://www.w3.org/2001/XMLSchema-instance";> - <stix:STIX_Header> - <stix:Handling> - <marking:Marking> - <marking:Controlled_Structure>../../../../descendant-or-self::node()</marking:Controlled_Structure> - <marking:Marking_Structure color="WHITE" xsi:type="tlpMarking:TLPMarkingStructureType"/> - <marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType"> - <TOUMarking:Terms_Of_Use>zeustracker.abuse.ch | Abuse source[https://sslbl.abuse.ch/blacklist/] - As for all abuse.ch projects, the use of the SSL Blacklist is free for both commercial and non-commercial usage without any limitation. However, if you are a commercial vendor of security software/services and you want to integrate data from the SSL Blacklist into your products / services, you will have to ask for permission first by contacting me using the contact form [http://www.abuse.ch/?page_id=4727].' -</TOUMarking:Terms_Of_Use> - </marking:Marking_Structure> - <marking:Marking_Structure xsi:type="simpleMarking:SimpleMarkingStructureType"> - <simpleMarking:Statement>Unclassified (Public)</simpleMarking:Statement> - </marking:Marking_Structure> - </marking:Marking> - </stix:Handling> - </stix:STIX_Header> - <stix:Observables cybox_major_version="2" cybox_minor_version="1" cybox_update_version="0"> - <cybox:Observable id="opensource:Observable-eae86c81-73ec-4ee6-87b6-31a8fa3fe5ac"> - <cybox:Observable_Composition operator="OR"> - <cybox:Observable idref="opensource:Observable-013f5351-5e03-4256-8405-ab3342146755"> - </cybox:Observable> - <cybox:Observable idref="opensource:Observable-3bb01333-456b-4f2c-9d40-d35f08702f74"> - </cybox:Observable> - <cybox:Observable idref="opensource:Observable-c0974652-6074-4410-aa49-3cf828a39663"> - </cybox:Observable> - </cybox:Observable_Composition> - </cybox:Observable> - </stix:Observables> -</stix:STIX_Package> - </taxii_11:Content> - <taxii_11:Timestamp_Label>2016-02-22T15:24:02.987068Z</taxii_11:Timestamp_Label> - </taxii_11:Content_Block> - <taxii_11:Content_Block> - <taxii_11:Content_Binding binding_id="urn:stix.mitre.org:xml:1.1.1"/> - <taxii_11:Content> - <stix:STIX_Package id="edge:Package-f74faad4-5796-4f11-955c-fc8d23852fe1" timestamp="2016-02-22T15:24:02.987620+00:00" version="1.1.1" xmlns:stixCommon="http://stix.mitre.org/common-1"; xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"; xmlns:simpleMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1"; xmlns:edge="http://soltra.com/"; xmlns:DomainNameObj="http://cybox.mitre.org/objects#DomainNameObject-1"; xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"; xmlns:opensource="http://hailataxii.com"; xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"; xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1"; xmlns:TOUMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1"; xmlns:stix="http://stix.mitre.org/stix-1"; xmlns:marking="http://data-marking.mitre.org/Marking-1"; xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1"; xmlns:cyboxCommon="http://cybox.mi tre.org/common-2" xmlns:cybox="http://cybox.mitre.org/cybox-2"; xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";> - <stix:STIX_Header> - <stix:Handling> - <marking:Marking> - <marking:Controlled_Structure>../../../../descendant-or-self::node()</marking:Controlled_Structure> - <marking:Marking_Structure color="WHITE" xsi:type="tlpMarking:TLPMarkingStructureType"/> - <marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType"> - <TOUMarking:Terms_Of_Use>zeustracker.abuse.ch | Abuse source[https://sslbl.abuse.ch/blacklist/] - As for all abuse.ch projects, the use of the SSL Blacklist is free for both commercial and non-commercial usage without any limitation. However, if you are a commercial vendor of security software/services and you want to integrate data from the SSL Blacklist into your products / services, you will have to ask for permission first by contacting me using the contact form [http://www.abuse.ch/?page_id=4727].' -</TOUMarking:Terms_Of_Use> - </marking:Marking_Structure> - <marking:Marking_Structure xsi:type="simpleMarking:SimpleMarkingStructureType"> - <simpleMarking:Statement>Unclassified (Public)</simpleMarking:Statement> - </marking:Marking_Structure> - </marking:Marking> - </stix:Handling> - </stix:STIX_Header> - <stix:Observables cybox_major_version="2" cybox_minor_version="1" cybox_update_version="0"> - <cybox:Observable id="opensource:Observable-013f5351-5e03-4256-8405-ab3342146755" sighting_count="1"> - <cybox:Title>Domain: goomjav1kaformjavkd.com</cybox:Title> - <cybox:Description>Domain: goomjav1kaformjavkd.com | isFQDN: True | </cybox:Description> - <cybox:Object id="opensource:DomainName-6b44b4b4-61e0-40dd-8b25-6c1ac935f6e1"> - <cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType"> - <DomainNameObj:Value condition="Equals">goomjav1kaformjavkd.com</DomainNameObj:Value> - </cybox:Properties> - </cybox:Object> - </cybox:Observable> - </stix:Observables> -</stix:STIX_Package> - </taxii_11:Content> - <taxii_11:Timestamp_Label>2016-02-22T15:24:02.988668Z</taxii_11:Timestamp_Label> - </taxii_11:Content_Block> - <taxii_11:Content_Block> - <taxii_11:Content_Binding binding_id="urn:stix.mitre.org:xml:1.1.1"/> - <taxii_11:Content> - <stix:STIX_Package id="edge:Package-ffde65a2-9c4d-4710-bde1-61b07fe681da" timestamp="2016-02-22T15:24:02.989380+00:00" version="1.1.1" xmlns:stixCommon="http://stix.mitre.org/common-1"; xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"; xmlns:simpleMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1"; xmlns:edge="http://soltra.com/"; xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"; xmlns:opensource="http://hailataxii.com"; xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"; xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"; xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1"; xmlns:TOUMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1"; xmlns:stix="http://stix.mitre.org/stix-1"; xmlns:marking="http://data-marking.mitre.org/Marking-1"; xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1"; xmlns:cyboxCommon="http://cybox.mitre.org/comm on-2" xmlns:cybox="http://cybox.mitre.org/cybox-2"; xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";> - <stix:STIX_Header> - <stix:Handling> - <marking:Marking> - <marking:Controlled_Structure>../../../../descendant-or-self::node()</marking:Controlled_Structure> - <marking:Marking_Structure color="WHITE" xsi:type="tlpMarking:TLPMarkingStructureType"/> - <marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType"> - <TOUMarking:Terms_Of_Use>zeustracker.abuse.ch | Abuse source[https://sslbl.abuse.ch/blacklist/] - As for all abuse.ch projects, the use of the SSL Blacklist is free for both commercial and non-commercial usage without any limitation. However, if you are a commercial vendor of security software/services and you want to integrate data from the SSL Blacklist into your products / services, you will have to ask for permission first by contacting me using the contact form [http://www.abuse.ch/?page_id=4727].' -</TOUMarking:Terms_Of_Use> - </marking:Marking_Structure> - <marking:Marking_Structure xsi:type="simpleMarking:SimpleMarkingStructureType"> - <simpleMarking:Statement>Unclassified (Public)</simpleMarking:Statement> - </marking:Marking_Structure> - </marking:Marking> - </stix:Handling> - </stix:STIX_Header> - <stix:Observables cybox_major_version="2" cybox_minor_version="1" cybox_update_version="0"> - <cybox:Observable id="opensource:Observable-c0974652-6074-4410-aa49-3cf828a39663" sighting_count="1"> - <cybox:Title>File: pixel.jpg</cybox:Title> - <cybox:Description>FileName: pixel.jpg | FileHash: 3903f963c6ff179fe4cff8d54a26326f | </cybox:Description> - <cybox:Object id="opensource:File-01d1513d-f093-4482-9fa5-10d5dd702698"> - <cybox:Properties xsi:type="FileObj:FileObjectType"> - <FileObj:File_Name>pixel.jpg</FileObj:File_Name> - <FileObj:File_Format>jpg</FileObj:File_Format> - <FileObj:Hashes> - <cyboxCommon:Hash> - <cyboxCommon:Type xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type> - <cyboxCommon:Simple_Hash_Value condition="Equals">3903f963c6ff179fe4cff8d54a26326f</cyboxCommon:Simple_Hash_Value> - </cyboxCommon:Hash> - </FileObj:Hashes> - </cybox:Properties> - </cybox:Object> - </cybox:Observable> - </stix:Observables> -</stix:STIX_Package> - </taxii_11:Content> - <taxii_11:Timestamp_Label>2016-02-22T15:24:02.991399Z</taxii_11:Timestamp_Label> - </taxii_11:Content_Block> - <taxii_11:Content_Block> - <taxii_11:Content_Binding binding_id="urn:stix.mitre.org:xml:1.1.1"/> - <taxii_11:Content> - <stix:STIX_Package id="edge:Package-1015dcb2-3095-4917-86ad-21937dc67ebf" timestamp="2016-02-22T15:24:02.992167+00:00" version="1.1.1" xmlns:stixCommon="http://stix.mitre.org/common-1"; xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"; xmlns:simpleMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1"; xmlns:edge="http://soltra.com/"; xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"; xmlns:opensource="http://hailataxii.com"; xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"; xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1"; xmlns:TOUMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1"; xmlns:stix="http://stix.mitre.org/stix-1"; xmlns:marking="http://data-marking.mitre.org/Marking-1"; xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1"; xmlns:cyboxCommon="http://cybox.mitre.org/common-2"; xmlns:URIObj="http://cybox.mitre.org/objects#URIObject -2" xmlns:cybox="http://cybox.mitre.org/cybox-2"; xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";> - <stix:STIX_Header> - <stix:Handling> - <marking:Marking> - <marking:Controlled_Structure>../../../../descendant-or-self::node()</marking:Controlled_Structure> - <marking:Marking_Structure color="WHITE" xsi:type="tlpMarking:TLPMarkingStructureType"/> - <marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType"> - <TOUMarking:Terms_Of_Use>zeustracker.abuse.ch | Abuse source[https://sslbl.abuse.ch/blacklist/] - As for all abuse.ch projects, the use of the SSL Blacklist is free for both commercial and non-commercial usage without any limitation. However, if you are a commercial vendor of security software/services and you want to integrate data from the SSL Blacklist into your products / services, you will have to ask for permission first by contacting me using the contact form [http://www.abuse.ch/?page_id=4727].' -</TOUMarking:Terms_Of_Use> - </marking:Marking_Structure> - <marking:Marking_Structure xsi:type="simpleMarking:SimpleMarkingStructureType"> - <simpleMarking:Statement>Unclassified (Public)</simpleMarking:Statement> - </marking:Marking_Structure> - </marking:Marking> - </stix:Handling> - </stix:STIX_Header> - <stix:Observables cybox_major_version="2" cybox_minor_version="1" cybox_update_version="0"> - <cybox:Observable id="opensource:Observable-3bb01333-456b-4f2c-9d40-d35f08702f74" sighting_count="1"> - <cybox:Title>URI: http://goomjav1kaformjavkd.com/neverwind/tmp/pixel.jpg</cybox:Title> - <cybox:Description>URI: http://goomjav1kaformjavkd.com/neverwind/tmp/pixel.jpg | Type: URL | </cybox:Description> - <cybox:Object id="opensource:URI-1859b919-5239-42d2-a995-7066f60ce058"> - <cybox:Properties type="URL" xsi:type="URIObj:URIObjectType"> - <URIObj:Value condition="Equals">http://goomjav1kaformjavkd.com/neverwind/tmp/pixel.jpg</URIObj:Value> - </cybox:Properties> - </cybox:Object> - </cybox:Observable> - </stix:Observables> -</stix:STIX_Package> - </taxii_11:Content> - <taxii_11:Timestamp_Label>2016-02-22T15:24:02.993399Z</taxii_11:Timestamp_Label> - </taxii_11:Content_Block> - <taxii_11:Content_Block> - <taxii_11:Content_Binding binding_id="urn:stix.mitre.org:xml:1.1.1"/> - <taxii_11:Content> - <stix:STIX_Package id="edge:Package-94aa988a-0871-4c7e-9209-15d85ca51af9" timestamp="2016-02-22T15:24:02.993864+00:00" version="1.1.1" xmlns:stixCommon="http://stix.mitre.org/common-1"; xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"; xmlns:indicator="http://stix.mitre.org/Indicator-2"; xmlns:simpleMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1"; xmlns:edge="http://soltra.com/"; xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"; xmlns:opensource="http://hailataxii.com"; xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"; xmlns:ttp="http://stix.mitre.org/TTP-1"; xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1"; xmlns:TOUMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1"; xmlns:stix="http://stix.mitre.org/stix-1"; xmlns:marking="http://data-marking.mitre.org/Marking-1"; xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1"; xmlns:cyboxCom mon="http://cybox.mitre.org/common-2"; xmlns:cybox="http://cybox.mitre.org/cybox-2"; xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";> - <stix:STIX_Header> - <stix:Handling> - <marking:Marking> - <marking:Controlled_Structure>../../../../descendant-or-self::node()</marking:Controlled_Structure> - <marking:Marking_Structure color="WHITE" xsi:type="tlpMarking:TLPMarkingStructureType"/> - <marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType"> - <TOUMarking:Terms_Of_Use>zeustracker.abuse.ch | Abuse source[https://sslbl.abuse.ch/blacklist/] - As for all abuse.ch projects, the use of the SSL Blacklist is free for both commercial and non-commercial usage without any limitation. However, if you are a commercial vendor of security software/services and you want to integrate data from the SSL Blacklist into your products / services, you will have to ask for permission first by contacting me using the contact form [http://www.abuse.ch/?page_id=4727].' -</TOUMarking:Terms_Of_Use> - </marking:Marking_Structure> - <marking:Marking_Structure xsi:type="simpleMarking:SimpleMarkingStructureType"> - <simpleMarking:Statement>Unclassified (Public)</simpleMarking:Statement> - </marking:Marking_Structure> - </marking:Marking> - </stix:Handling> - </stix:STIX_Header> - <stix:Indicators> - <stix:Indicator id="opensource:indicator-b2c2e9af-21e6-4378-bf5c-51ab7af67e5b" timestamp="2014-10-31T16:44:24.742835+00:00" version="2.1.1" xsi:type="indicator:IndicatorType"> - <indicator:Title>ZeuS Tracker (online)| 72.55.133.246/~security/zuse/config.bin (2014-10-21) | This IP address has been identified as malicious by zeustracker.abuse.ch</indicator:Title> - <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type> - <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type> - <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> - <indicator:Description>This IP address 72.55.133.246 has been identified as malicious by zeustracker.abuse.ch. For more detailed infomation about this indicator go to [CAUTION!!Read-URL-Before-Click] [https://zeustracker.abuse.ch/monitor.php?host=72.55.133.246].</indicator:Description> - <indicator:Observable idref="opensource:Observable-daf12252-bd96-473f-ac61-ace479e475c8"> - </indicator:Observable> - <indicator:Indicated_TTP> - <stixCommon:TTP idref="opensource:ttp-47c816ab-157d-4702-b427-6ad992c5bf8a" xsi:type="ttp:TTPType"/> - </indicator:Indicated_TTP> - <indicator:Producer> - <stixCommon:Identity id="opensource:Identity-00f9a6eb-144e-468e-a140-d21478c17e6a"> - <stixCommon:Name>zeustracker.abuse.ch</stixCommon:Name> - </stixCommon:Identity> - <stixCommon:Time> - <cyboxCommon:Produced_Time>2014-10-21T00:00:00+00:00</cyboxCommon:Produced_Time> - <cyboxCommon:Received_Time>2014-10-22T15:01:33+00:00</cyboxCommon:Received_Time> - </stixCommon:Time> - </indicator:Producer> - </stix:Indicator> - </stix:Indicators> -</stix:STIX_Package> - </taxii_11:Content> - <taxii_11:Timestamp_Label>2016-02-22T15:24:02.995633Z</taxii_11:Timestamp_Label> - </taxii_11:Content_Block> - <taxii_11:Content_Block> - <taxii_11:Content_Binding binding_id="urn:stix.mitre.org:xml:1.1.1"/> - <taxii_11:Content> - <stix:STIX_Package id="edge:Package-156578a9-f653-40a4-9b16-51821a7c6f8e" timestamp="2016-02-22T15:24:02.996219+00:00" version="1.1.1" xmlns:stixCommon="http://stix.mitre.org/common-1"; xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"; xmlns:simpleMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1"; xmlns:edge="http://soltra.com/"; xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"; xmlns:opensource="http://hailataxii.com"; xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"; xmlns:ttp="http://stix.mitre.org/TTP-1"; xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1"; xmlns:TOUMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1"; xmlns:stix="http://stix.mitre.org/stix-1"; xmlns:marking="http://data-marking.mitre.org/Marking-1"; xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1"; xmlns:cyboxCommon="http://cybox.mitre.org/common-2"; xmlns:cybox="h ttp://cybox.mitre.org/cybox-2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";> - <stix:STIX_Header> - <stix:Handling> - <marking:Marking> - <marking:Controlled_Structure>../../../../descendant-or-self::node()</marking:Controlled_Structure> - <marking:Marking_Structure color="WHITE" xsi:type="tlpMarking:TLPMarkingStructureType"/> - <marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType"> - <TOUMarking:Terms_Of_Use>zeustracker.abuse.ch | Abuse source[https://sslbl.abuse.ch/blacklist/] - As for all abuse.ch projects, the use of the SSL Blacklist is free for both commercial and non-commercial usage without any limitation. However, if you are a commercial vendor of security software/services and you want to integrate data from the SSL Blacklist into your products / services, you will have to ask for permission first by contacting me using the contact form [http://www.abuse.ch/?page_id=4727].' -</TOUMarking:Terms_Of_Use> - </marking:Marking_Structure> - <marking:Marking_Structure xsi:type="simpleMarking:SimpleMarkingStructureType"> - <simpleMarking:Statement>Unclassified (Public)</simpleMarking:Statement> - </marking:Marking_Structure> - </marking:Marking> - </stix:Handling> - </stix:STIX_Header> - <stix:TTPs> - <stix:TTP id="opensource:ttp-47c816ab-157d-4702-b427-6ad992c5bf8a" timestamp="2014-10-31T16:44:24.743908+00:00" version="1.1.1" xsi:type="ttp:TTPType"> - <ttp:Title>ZeuS</ttp:Title> - <ttp:Behavior> - <ttp:Malware> - <ttp:Malware_Instance id="opensource:malware-bd3ff8da-50c9-4556-8bb6-dffbff4b2cc6"> - <ttp:Type xsi:type="stixVocabs:MalwareTypeVocab-1.0">Remote Access Trojan</ttp:Type> - <ttp:Name>ZeuS</ttp:Name> - <ttp:Name>Zbot</ttp:Name> - <ttp:Name>Zeus</ttp:Name> - <ttp:Description>Zeus, ZeuS, or Zbot is Trojan horse computer malware that runs on computers running under versions of the Microsoft Windows operating system. While it is capable of being used to carry out many malicious and criminal tasks, it is often used to steal banking information by man-in-the-browser keystroke logging and form grabbing. It is also used to install the CryptoLocker ransomware.[1] Zeus is spread mainly through drive-by downloads and phishing schemes. (2014(http://en.wikipedia.org/wiki/Zeus_%28Trojan_horse%29))</ttp:Description> - <ttp:Short_Description>Zeus, ZeuS, or Zbot is Trojan horse computer malware effects Microsoft Windows operating system</ttp:Short_Description> - </ttp:Malware_Instance> - </ttp:Malware> - </ttp:Behavior> - </stix:TTP> - </stix:TTPs> -</stix:STIX_Package> - </taxii_11:Content> - <taxii_11:Timestamp_Label>2016-02-22T15:24:02.996944Z</taxii_11:Timestamp_Label> - </taxii_11:Content_Block> - <taxii_11:Content_Block> - <taxii_11:Content_Binding binding_id="urn:stix.mitre.org:xml:1.1.1"/> - <taxii_11:Content> - <stix:STIX_Package id="edge:Package-5ccec8a2-37a4-4f68-b921-fe7b5ec4d114" timestamp="2016-02-22T15:24:02.997476+00:00" version="1.1.1" xmlns:stixCommon="http://stix.mitre.org/common-1"; xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"; xmlns:simpleMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1"; xmlns:edge="http://soltra.com/"; xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"; xmlns:opensource="http://hailataxii.com"; xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"; xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1"; xmlns:TOUMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1"; xmlns:stix="http://stix.mitre.org/stix-1"; xmlns:marking="http://data-marking.mitre.org/Marking-1"; xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1"; xmlns:cyboxCommon="http://cybox.mitre.org/common-2"; xmlns:cybox="http://cybox.mitre.org/cybox-2"; xmlns:xsi ="http://www.w3.org/2001/XMLSchema-instance";> - <stix:STIX_Header> - <stix:Handling> - <marking:Marking> - <marking:Controlled_Structure>../../../../descendant-or-self::node()</marking:Controlled_Structure> - <marking:Marking_Structure color="WHITE" xsi:type="tlpMarking:TLPMarkingStructureType"/> - <marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType"> - <TOUMarking:Terms_Of_Use>zeustracker.abuse.ch | Abuse source[https://sslbl.abuse.ch/blacklist/] - As for all abuse.ch projects, the use of the SSL Blacklist is free for both commercial and non-commercial usage without any limitation. However, if you are a commercial vendor of security software/services and you want to integrate data from the SSL Blacklist into your products / services, you will have to ask for permission first by contacting me using the contact form [http://www.abuse.ch/?page_id=4727].' -</TOUMarking:Terms_Of_Use> - </marking:Marking_Structure> - <marking:Marking_Structure xsi:type="simpleMarking:SimpleMarkingStructureType"> - <simpleMarking:Statement>Unclassified (Public)</simpleMarking:Statement> - </marking:Marking_Structure> - </marking:Marking> - </stix:Handling> - </stix:STIX_Header> - <stix:Observables cybox_major_version="2" cybox_minor_version="1" cybox_update_version="0"> - <cybox:Observable id="opensource:Observable-daf12252-bd96-473f-ac61-ace479e475c8"> - <cybox:Observable_Composition operator="OR"> - <cybox:Observable idref="opensource:Observable-0e0ed508-f5b7-4b35-8f82-5a044bca7096"> - </cybox:Observable> - <cybox:Observable idref="opensource:Observable-62e3997e-ad52-4e9d-82f8-28dbb9a64525"> - </cybox:Observable> - <cybox:Observable idref="opensource:Observable-85f3d0e1-ba5b-45bf-a4b4-56b0cccd3615"> - </cybox:Observable> - </cybox:Observable_Composition> - </cybox:Observable> - </stix:Observables> -</stix:STIX_Package> - </taxii_11:Content> - <taxii_11:Timestamp_Label>2016-02-22T15:24:02.998013Z</taxii_11:Timestamp_Label> - </taxii_11:Content_Block> - <taxii_11:Content_Block> - <taxii_11:Content_Binding binding_id="urn:stix.mitre.org:xml:1.1.1"/> - <taxii_11:Content> - <stix:STIX_Package id="edge:Package-fa492343-0c3d-4003-bb34-b2906607cbe4" timestamp="2016-02-22T15:24:02.998513+00:00" version="1.1.1" xmlns:stixCommon="http://stix.mitre.org/common-1"; xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"; xmlns:simpleMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1"; xmlns:edge="http://soltra.com/"; xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"; xmlns:opensource="http://hailataxii.com"; xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"; xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"; xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1"; xmlns:TOUMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1"; xmlns:stix="http://stix.mitre.org/stix-1"; xmlns:marking="http://data-marking.mitre.org/Marking-1"; xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1"; xmlns:cyboxCommon="http://cybox.mitre.org/comm on-2" xmlns:cybox="http://cybox.mitre.org/cybox-2"; xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";> - <stix:STIX_Header> - <stix:Handling> - <marking:Marking> - <marking:Controlled_Structure>../../../../descendant-or-self::node()</marking:Controlled_Structure> - <marking:Marking_Structure color="WHITE" xsi:type="tlpMarking:TLPMarkingStructureType"/> - <marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType"> - <TOUMarking:Terms_Of_Use>zeustracker.abuse.ch | Abuse source[https://sslbl.abuse.ch/blacklist/] - As for all abuse.ch projects, the use of the SSL Blacklist is free for both commercial and non-commercial usage without any limitation. However, if you are a commercial vendor of security software/services and you want to integrate data from the SSL Blacklist into your products / services, you will have to ask for permission first by contacting me using the contact form [http://www.abuse.ch/?page_id=4727].' -</TOUMarking:Terms_Of_Use> - </marking:Marking_Structure> - <marking:Marking_Structure xsi:type="simpleMarking:SimpleMarkingStructureType"> - <simpleMarking:Statement>Unclassified (Public)</simpleMarking:Statement> - </marking:Marking_Structure> - </marking:Marking> - </stix:Handling> - </stix:STIX_Header> - <stix:Observables cybox_major_version="2" cybox_minor_version="1" cybox_update_version="0"> - <cybox:Observable id="opensource:Observable-85f3d0e1-ba5b-45bf-a4b4-56b0cccd3615" sighting_count="1"> - <cybox:Title>File: config.bin</cybox:Title> - <cybox:Description>FileName: config.bin | FileHash: aea75d1e44bc66ba13877654faa003ef | </cybox:Description> - <cybox:Object id="opensource:File-e591355a-f95c-4e0f-9bf8-392bcaa9d4d1"> - <cybox:Properties xsi:type="FileObj:FileObjectType"> - <FileObj:File_Name>config.bin</FileObj:File_Name> - <FileObj:File_Format>bin</FileObj:File_Format> - <FileObj:Hashes> - <cyboxCommon:Hash> - <cyboxCommon:Type xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type> - <cyboxCommon:Simple_Hash_Value condition="Equals">aea75d1e44bc66ba13877654faa003ef</cyboxCommon:Simple_Hash_Value> - </cyboxCommon:Hash> - </FileObj:Hashes> - </cybox:Properties> - </cybox:Object> - </cybox:Observable> - </stix:Observables> -</stix:STIX_Package> - </taxii_11:Content> - <taxii_11:Timestamp_Label>2016-02-22T15:24:02.999665Z</taxii_11:Timestamp_Label> - </taxii_11:Content_Block> - <taxii_11:Content_Block> - <taxii_11:Content_Binding binding_id="urn:stix.mitre.org:xml:1.1.1"/> - <taxii_11:Content> - <stix:STIX_Package id="edge:Package-05419212-885f-4eac-b986-c7cc006e0ca5" timestamp="2016-02-22T15:24:03.000212+00:00" version="1.1.1" xmlns:stixCommon="http://stix.mitre.org/common-1"; xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"; xmlns:simpleMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1"; xmlns:edge="http://soltra.com/"; xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"; xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"; xmlns:opensource="http://hailataxii.com"; xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"; xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1"; xmlns:TOUMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1"; xmlns:stix="http://stix.mitre.org/stix-1"; xmlns:marking="http://data-marking.mitre.org/Marking-1"; xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1"; xmlns:cyboxCommon="http://cybox.mitre.or g/common-2" xmlns:cybox="http://cybox.mitre.org/cybox-2"; xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";> - <stix:STIX_Header> - <stix:Handling> - <marking:Marking> - <marking:Controlled_Structure>../../../../descendant-or-self::node()</marking:Controlled_Structure> - <marking:Marking_Structure color="WHITE" xsi:type="tlpMarking:TLPMarkingStructureType"/> - <marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType"> - <TOUMarking:Terms_Of_Use>zeustracker.abuse.ch | Abuse source[https://sslbl.abuse.ch/blacklist/] - As for all abuse.ch projects, the use of the SSL Blacklist is free for both commercial and non-commercial usage without any limitation. However, if you are a commercial vendor of security software/services and you want to integrate data from the SSL Blacklist into your products / services, you will have to ask for permission first by contacting me using the contact form [http://www.abuse.ch/?page_id=4727].' -</TOUMarking:Terms_Of_Use> - </marking:Marking_Structure> - <marking:Marking_Structure xsi:type="simpleMarking:SimpleMarkingStructureType"> - <simpleMarking:Statement>Unclassified (Public)</simpleMarking:Statement> - </marking:Marking_Structure> - </marking:Marking> - </stix:Handling> - </stix:STIX_Header> - <stix:Observables cybox_major_version="2" cybox_minor_version="1" cybox_update_version="0"> - <cybox:Observable id="opensource:Observable-0e0ed508-f5b7-4b35-8f82-5a044bca7096" sighting_count="1"> - <cybox:Title>IP: 72.55.133.246</cybox:Title> - <cybox:Description>IPv4: 72.55.133.246 | isSource: True | </cybox:Description> - <cybox:Object id="opensource:Address-484690ca-d560-4178-aae0-3e1d477056e8"> - <cybox:Properties category="ipv4-addr" is_source="true" xsi:type="AddressObj:AddressObjectType"> - <AddressObj:Address_Value condition="Equal">72.55.133.246</AddressObj:Address_Value> - </cybox:Properties> - </cybox:Object> - </cybox:Observable> - </stix:Observables> -</stix:STIX_Package> - </taxii_11:Content> - <taxii_11:Timestamp_Label>2016-02-22T15:24:03.000922Z</taxii_11:Timestamp_Label> - </taxii_11:Content_Block> - <taxii_11:Content_Block> - <taxii_11:Content_Binding binding_id="urn:stix.mitre.org:xml:1.1.1"/> - <taxii_11:Content> - <stix:STIX_Package id="edge:Package-fd722082-edf1-4a68-ac65-fee12161124e" timestamp="2016-02-22T15:24:03.001433+00:00" version="1.1.1" xmlns:stixCommon="http://stix.mitre.org/common-1"; xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"; xmlns:simpleMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1"; xmlns:edge="http://soltra.com/"; xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"; xmlns:opensource="http://hailataxii.com"; xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"; xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1"; xmlns:TOUMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1"; xmlns:stix="http://stix.mitre.org/stix-1"; xmlns:marking="http://data-marking.mitre.org/Marking-1"; xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1"; xmlns:cyboxCommon="http://cybox.mitre.org/common-2"; xmlns:URIObj="http://cybox.mitre.org/objects#URIObject -2" xmlns:cybox="http://cybox.mitre.org/cybox-2"; xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";> - <stix:STIX_Header> - <stix:Handling> - <marking:Marking> - <marking:Controlled_Structure>../../../../descendant-or-self::node()</marking:Controlled_Structure> - <marking:Marking_Structure color="WHITE" xsi:type="tlpMarking:TLPMarkingStructureType"/> - <marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType"> - <TOUMarking:Terms_Of_Use>zeustracker.abuse.ch | Abuse source[https://sslbl.abuse.ch/blacklist/] - As for all abuse.ch projects, the use of the SSL Blacklist is free for both commercial and non-commercial usage without any limitation. However, if you are a commercial vendor of security software/services and you want to integrate data from the SSL Blacklist into your products / services, you will have to ask for permission first by contacting me using the contact form [http://www.abuse.ch/?page_id=4727].' -</TOUMarking:Terms_Of_Use> - </marking:Marking_Structure> - <marking:Marking_Structure xsi:type="simpleMarking:SimpleMarkingStructureType"> - <simpleMarking:Statement>Unclassified (Public)</simpleMarking:Statement> - </marking:Marking_Structure> - </marking:Marking> - </stix:Handling> - </stix:STIX_Header> - <stix:Observables cybox_major_version="2" cybox_minor_version="1" cybox_update_version="0"> - <cybox:Observable id="opensource:Observable-62e3997e-ad52-4e9d-82f8-28dbb9a64525" sighting_count="1"> - <cybox:Title>URI: http://72.55.133.246/~security/zuse/config.bin</cybox:Title> - <cybox:Description>URI: http://72.55.133.246/~security/zuse/config.bin | Type: URL | </cybox:Description> - <cybox:Object id="opensource:URI-c42b3b2b-267e-489f-95ed-11b5a2f4d97b"> - <cybox:Properties type="URL" xsi:type="URIObj:URIObjectType"> - <URIObj:Value condition="Equals">http://72.55.133.246/~security/zuse/config.bin</URIObj:Value> - </cybox:Properties> - </cybox:Object> - </cybox:Observable> - </stix:Observables> -</stix:STIX_Package> - </taxii_11:Content> - <taxii_11:Timestamp_Label>2016-02-22T15:24:03.002094Z</taxii_11:Timestamp_Label> - </taxii_11:Content_Block> - <taxii_11:Content_Block> - <taxii_11:Content_Binding binding_id="urn:stix.mitre.org:xml:1.1.1"/> - <taxii_11:Content> - <stix:STIX_Package id="edge:Package-59971f10-3012-4114-b434-a234dbc24732" timestamp="2016-02-22T15:24:03.002389+00:00" version="1.1.1" xmlns:stixCommon="http://stix.mitre.org/common-1"; xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"; xmlns:indicator="http://stix.mitre.org/Indicator-2"; xmlns:simpleMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1"; xmlns:edge="http://soltra.com/"; xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"; xmlns:opensource="http://hailataxii.com"; xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"; xmlns:ttp="http://stix.mitre.org/TTP-1"; xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1"; xmlns:TOUMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1"; xmlns:stix="http://stix.mitre.org/stix-1"; xmlns:marking="http://data-marking.mitre.org/Marking-1"; xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1"; xmlns:cyboxCom mon="http://cybox.mitre.org/common-2"; xmlns:cybox="http://cybox.mitre.org/cybox-2"; xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";> - <stix:STIX_Header> - <stix:Handling> - <marking:Marking> - <marking:Controlled_Structure>../../../../descendant-or-self::node()</marking:Controlled_Structure> - <marking:Marking_Structure color="WHITE" xsi:type="tlpMarking:TLPMarkingStructureType"/> - <marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType"> - <TOUMarking:Terms_Of_Use>zeustracker.abuse.ch | Abuse source[https://sslbl.abuse.ch/blacklist/] - As for all abuse.ch projects, the use of the SSL Blacklist is free for both commercial and non-commercial usage without any limitation. However, if you are a commercial vendor of security software/services and you want to integrate data from the SSL Blacklist into your products / services, you will have to ask for permission first by contacting me using the contact form [http://www.abuse.ch/?page_id=4727].' -</TOUMarking:Terms_Of_Use> - </marking:Marking_Structure> - <marking:Marking_Structure xsi:type="simpleMarking:SimpleMarkingStructureType"> - <simpleMarking:Statement>Unclassified (Public)</simpleMarking:Statement> - </marking:Marking_Structure> - </marking:Marking> - </stix:Handling> - </stix:STIX_Header> - <stix:Indicators> - <stix:Indicator id="opensource:indicator-31111ae5-2809-4aa2-82cb-170b14c12332" timestamp="2014-10-31T16:44:24.807815+00:00" version="2.1.1" xsi:type="indicator:IndicatorType"> - <indicator:Title>ZeuS Tracker (offline)| richcomms.co.za/robot/config.bin (2014-10-21) | This domain has been identified as malicious by zeustracker.abuse.ch</indicator:Title> - <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type> - <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type> - <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type> - <indicator:Description>This domain richcomms.co.za has been identified as malicious by zeustracker.abuse.ch. For more detailed infomation about this indicator go to [CAUTION!!Read-URL-Before-Click] [https://zeustracker.abuse.ch/monitor.php?host=richcomms.co.za].</indicator:Description> - <indicator:Observable idref="opensource:Observable-70b67251-e34d-4f8d-9ed5-b3082039eb12"> - </indicator:Observable> - <indicator:Indicated_TTP> - <stixCommon:TTP idref="opensource:ttp-8d762623-4326-4b0a-b07a-8d1e05b5159a" xsi:type="ttp:TTPType"/> - </indicator:Indicated_TTP> - <indicator:Producer> - <stixCommon:Identity id="opensource:Identity-dc09bda7-00e2-4547-90d7-dfc84e49046e"> - <stixCommon:Name>zeustracker.abuse.ch</stixCommon:Name> - </stixCommon:Identity> - <stixCommon:Time> - <cyboxCommon:Produced_Time>2014-10-21T00:00:00+00:00</cyboxCommon:Produced_Time> - <cyboxCommon:Received_Time>2014-10-21T15:07:42+00:00</cyboxCommon:Received_Time> - </stixCommon:Time> - </indicator:Producer> - </stix:Indicator> - </stix:Indicators> -</stix:STIX_Package> - </taxii_11:Content> - <taxii_11:Timestamp_Label>2016-02-22T15:24:03.003689Z</taxii_11:Timestamp_Label> - </taxii_11:Content_Block> - <taxii_11:Content_Block> - <taxii_11:Content_Binding binding_id="urn:stix.mitre.org:xml:1.1.1"/> - <taxii_11:Content> - <stix:STIX_Package id="edge:Package-f012f58c-7bb1-4372-9b13-168f71eb2e46" timestamp="2016-02-22T15:24:03.004221+00:00" version="1.1.1" xmlns:stixCommon="http://stix.mitre.org/common-1"; xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"; xmlns:simpleMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1"; xmlns:edge="http://soltra.com/"; xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"; xmlns:opensource="http://hailataxii.com"; xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"; xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1"; xmlns:TOUMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Terms_Of_Use-1"; xmlns:stix="http://stix.mitre.org/stix-1"; xmlns:marking="http://data-marking.mitre.org/Marking-1"; xmlns:tdq="http://taxii.mitre.org/query/taxii_default_query-1"; xmlns:cyboxCommon="http://cybox.mitre.org/common-2"; xmlns:cybox="http://cybox.mitre.org/cybox-2"; xmlns:xsi ="http://www.w3.org/2001/XMLSchema-instance";> - <stix:STIX_Header> - <stix:Handling> - <marking:Marking> - <marking:Controlled_Structure>../../../../descendant-or-self::node()</marking:Controlled_Structure> - <marking:Marking_Structure color="WHITE" xsi:type="tlpMarking:TLPMarkingStructureType"/> - <marking:Marking_Structure xsi:type="TOUMarking:TermsOfUseMarkingStructureType"> - <TOUMarking:Terms_Of_Use>zeustracker.abuse.ch | Abuse source[https://sslbl.abuse.ch/blacklist/] - As for all abuse.ch projects, the use of the SSL Blacklist is free for both commercial and non-commercial usage without any limitation. However, if you are a commercial vendor of security software/services and you want to integrate data from the SSL Blacklist into your products / services, you will have to ask for permission first by contacting me using the contact form [http://www.abuse.ch/?page_id=4727].' -</TOUMarking:Terms_Of_Use> - </marking:Marking_Structure> - <marking:Marking_Structure xsi:type="simpleMarking:SimpleMarkingStructureType"> - <simpleMarking:Statement>Unclassified (Public)</simpleMarking:Statement> - </marking:Marking_Structure> - </marking:Marking> - </stix:Handling> - </stix:STIX_Header> - <stix:Observables cybox_major_version="2" cybox_minor_version="1" cybox_update_version="0"> - <cybox:Observable id="opensource:Observable-70b67251-e34d-4f8d-9ed5-b3082039eb12"> - <cybox:Observable_Composition operator="OR"> - <cybox:Observable idref="opensource:Observable-410babe8-6335-45e1-a0fc-f8ab45965c97"> - </cybox:Observable> - <cybox:Observable idref="opensource:Observable-ed2a237c-5f66-4577-a3f6-479efcf807cb"> - </cybox:Observable> - <cybox:Observable idref="opensource:Observable-3b4578c8-7dbb-449b-8b14-c87dadfda13d"> - </cybox:Observable> - </cybox:Observable_Composition> - </cybox:Observable> - </stix:Observables> -</stix:STIX_Package> - </taxii_11:Content> - <taxii_11:Timestamp_Label>2016-02-22T15:24:03.004759Z</taxii_11:Timestamp_Label> - </taxii_11:Content_Block> - <taxii_11:Content_Block> - <taxii_11:Content_Binding binding_id="urn:stix.mitre.org:xml:1.1.1"/> - <taxii_11:Content> - <stix:STIX_Package id="edge:Package-14caeee2-efd3-4537-937e-287f0cfa2050" timestamp="2016-02-22T15:24:03.144906+00:00" version="1.1.1" xmlns:stixCommon="http://stix.mitre.org/common-1"; xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"; xmlns:simpleMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1"; xmlns:edge="http://soltra.com/"; xmlns:DomainNameObj="http://cybox.mitre.org/objects#DomainNameObject-1"; xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"; xmlns:opensource="http://hailataxii.com"; xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"; xmlns:taxii="http://taxii.mitre.org/messages/taxii_xml_binding-1"; xmlns:TOUMarking="http
<TRUNCATED>
