"comment":"Source of the information - IR performed by the github user and pushed publicly",
"deleted":false,
"disable_correlation":false,
"timestamp":"1483886583",
"to_ids":false,
"type":"github-repository",
"uuid":"58724d03-65d4-4872-962a-4263950d210f",
"value":"rickey-g/fancybear"
},
{
"category":"External analysis",
"comment":"",
"deleted":false,
"disable_correlation":false,
"timestamp":"1483885861",
"to_ids":false,
"type":"comment",
"uuid":"58724d25-fbd4-4270-8f3c-4289950d210f",
"value":"# Fancy Bear Source Code \r\nThis repo contains actual source code found during IR.\r\nThe code provides a communication channel for the attacker and infected client. It uses Google's gmail servers to send and receive encoded messages.\r\n\r\n### Some artifacts are summorized below\r\n- Comments are in english, with a lot of grammar mistakes\r\n- Subject of an email is: '**piradi nomeri**'. This is Georgian language\r\n- It saves files with **dataluri_**timetsamp.dat. 'Dataluri' is also Georgian for \"details\".\r\n- In the email body it uses the word: \"**gamarjoba**\". Meaning 'Hello' in Russian and Georgian.\r\n\r\n### These are the Gmail account details used, I've verified they once worked (but not anymore!)\r\n- POP3_MAIL_IP = 'pop.gmail.com' \r\n- POP3_PORT = 995\r\n- POP3_ADDR = 'jassnovember30@gmail.com'\r\n- POP3_PASS = '30Jass11'\r\n- SMTP_MAIL_IP = 'smtp.gmail.com'\r\n- SMTP_PORT = 587\r\n- SMTP_TO_ADDR = 'userdf783@mailtransition.com'\r\n- SMTP_FROM_ADDR = 'ginabetz75@gmail.com'\r\n- SMTP_PASS = '75Gina75'\r\n \r\n### Command and Control server\r\n- XAS_IP = '104.152.187.66'\r\n- XAS_GATE = '/updates/'\r\n\r\n**The code is completely left as found on the original server, including the log files.**"
},
{
"category":"External analysis",
"comment":"Source of the information - IR performed by the github user and pushed publicly",
"deleted":false,
"disable_correlation":false,
"timestamp":"1483886648",
"to_ids":false,
"type":"link",
"uuid":"58724d6c-0e30-4815-aa87-499c950d210f",
"value":"https://github.com/rickey-g/fancybear"
},
{
"category":"Payload delivery",
"comment":"",
"deleted":false,
"disable_correlation":false,
"timestamp":"1483885980",
"to_ids":true,
"type":"email-src",
"uuid":"58724d9c-d95c-4221-91a4-409e950d210f",
"value":"jassnovember30@gmail.com"
},
{
"category":"Payload delivery",
"comment":"",
"deleted":false,
"disable_correlation":false,
"timestamp":"1483886002",
"to_ids":true,
"type":"email-dst",
"uuid":"58724db2-4a54-4329-93b6-444f950d210f",
"value":"userdf783@mailtransition.com"
},
{
"category":"Payload delivery",
"comment":"",
"deleted":false,
"disable_correlation":false,
"timestamp":"1483886056",
"to_ids":true,
"type":"email-dst",
"uuid":"58724de8-45f0-4f8e-be18-41a0950d210f",
"value":"ginabetz75@gmail.com"
},
{
"category":"Network activity",
"comment":"Command and Control server in default config",
