57 lines
252 KiB
JSON
57 lines
252 KiB
JSON
|
{
|
||
|
|
"Event": {
|
||
|
|
"analysis": "2",
|
||
|
|
"date": "2018-05-30",
|
||
|
|
"extends_uuid": "",
|
||
|
|
"info": "\"TrickBot\" and \"IcedID\" Botnet IOCs",
|
||
|
|
"publish_timestamp": "1527697645",
|
||
|
|
"published": true,
|
||
|
|
"threat_level_id": "2",
|
||
|
|
"timestamp": "1527697635",
|
||
|
|
"uuid": "5b0e8c35-c968-4704-983c-b77b0acd0835",
|
||
|
|
"Orgc": {
|
||
|
|
"name": "Synovus Financial",
|
||
|
|
"uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"
|
||
|
|
},
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#0088cc",
|
||
|
|
"name": "misp-galaxy:tool=\"Trick Bot\""
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#0088cc",
|
||
|
|
"name": "misp-galaxy:banker=\"IcedID\""
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#0088cc",
|
||
|
|
"name": "misp-galaxy:banker=\"Trickbot\""
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Support Tool",
|
||
|
|
"comment": "DomainTools Iris",
|
||
|
|
"data": "iVBORw0KGgoAAAANSUhEUgAABAcAAAKwCAIAAAEcvrF0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAP+lSURBVHhe7P1pkB3XeecN3oiZmC/vhzdiJmbemA8TrZbdbtvtVWrJm2x3u22YkrW53LCaarfVLctWy5ZNSJbERVzBIilKABeJi0hxlwoCJIqkJBIkQYAkSKCKIAESBEGQhR0oAIV939f5Z/7Pferc5yyZeW9W1a2q84sHF2fPrMxzznP2bFxIjDfpHYw/6R2MPy3vYNvba43pwoVvfOMbNDz77LM0tMf06dON6cKFF1544b777oNh8+bNp0+fpiN45JFHaLj11ltpQAD8rly5klaX3t5e/O7fv//9738/fuk4QemucvDEE08YUznw9ImxT0xSXTT+pHcw/qR3MP6kdzD+TJh3sHDReynGPomYqO+gt9EDoXmiM/HewWDO0NCQ8Zj4TIx3wOcO1q5du379eprFnWEmLhPgHezZs+fUqVN83GDDhg0nTpw4fvw4vPA+GAbFAl40TzgmwDvgc9+1a5c8ZRrwJmjYtm1b7pyxd+9eOJ48edLYJwLd/g6Y38+ePYsnyye+efNmGgAMHFkCKC40kGPHjsF3y5Ytxt7FTIByMDw8jKfJZwqrvABC6759+2g9cuQIXhjN5Pz58wijYtn8m0ufhBjLeNDV72DHjh3GdOECqhd5jnymgKUEBvklZ86cwTszFos80kgwPn2RS+a+YTzGli59B3j6fFiHDh06evQoDOrxEeT6jRs3wuB6ESkfCoR/4uU31TuAGO+xpRvfgTxQZGda8Sbwi4YpDHQB586dy0OZ8Nu3b7etNuJlo54+hV59Vt9DeY0GXfcO7CfIdwCyR563jmxfgLfCzppyhw4wJgtEN6Ycebi2IJ3egZF3oHyH5/T0z8QT6zfeNdFd74CPkr/M8qxM8Itqx24RAXnQdiwAHU6DHViwHdUjhhiPPJjyohjvWumid4AeAH6RtWkl9iOzO2IwsIaxA0jtL458cP/9vldoFRhAniyFXoLypcB9eKgve8lDfZnkhkYTWvHTN73Cg+2uciDYLSJBFHUZFr76lvv4FEzthp+8su1A1r5SqOgU41crXfoOCGuVU6dO0YqCojpifIi7d+8Ws6CeHcX4tRJ6r5+4Y4mKDjF+tdJF70CehYwC0UXc9+7dSwOxnx2n9e3JffXsKNKUsuE79r4JFd241k23vINQQx5Iy/LAgQM02HifHVCPjwJ3b3hTnTcarm8o/RoZ53cgbRhB/uatW7fSABjs8OHDtHphRElQPX3IoyvKTjmMwXO3Gc93IH9qYQan2R1+oLsoDCIR1Tugo2Cn76UwQF2M2zuQv9D+U0N/Nt1DI9LUycCNDpeBlW8bS+soNyhcHIbwbpqhl9o24/MOQs960Tu75C/kH8mQfHbsNqsH5+0S26hruZfmiJMX6aysW7cOvzc8tca+Pd5h54zROyhz63g6KhjEHmDg4/Y+U/fJ2i4q+9te1B9udC/q3ijGrwPG4h2om4bc/WLW+pQ2KFFhKMbPovB5SQCpo4CaVJAwdmre4W4bdW+UzGOor2/INK5g6G00emf24JfjTj1zhofnZNb+gV7vSNP4vAOIepSwqgCUe1/agL8h+wtn9uMvQcgZjWk9DY6dGRrXvIS/TSVYCMPb1xJH4iZoBxYxfh0wbu8A7nisvQNZ9qH5neHDKgwkT6AF99F4XSIpCBJGxHgEUIEhK4c8LbqqjOc7EOQhqjAQutuoQT0bqUwKEwHPrh5WwSD/6Vsv0Nd9r0SFN66dMRbvYM2OQ+Vv/a/veIFhDhw7zQehqumjR4/2LdMz9ZzUZJNJrmJLHirj4MGDNPziFfNVGApqOdTdH258rXHVCz2NXtSELKkcEA29m04Yi3dA5I+EedOmTXQE6q+y2zD0sgNIIpIUiYShwL13Jh5mL2o/CazCQOgO2BgF6vZGg7F7BwrOEpehzCMTEFiFoahHSasKA6GvQnIMZzhqZ0zfgdvR9T4aG/TLxFE9Lwq9wJEjR2hQAShwV3MSTPZ3b1xkh3FvQCjsVLfN2L2DyJ8n2BlNwpd5B+hoLZ09rTG9D1V545JZKkzo0qxwlC+sofAh9w4Zo3dAnamIL4Jz/2D1ZCFXPfGW8YsiWVgUMkElg9Lj1orS9OLYycX3DsA8ShURGMV3IE/K2IuI5DJ6Pbh0k6TpTVnGX9WztrGvErkiGmORa0nEUIBKjNY7sG8O8tmHXjMeTWRWcv/RUxKMLl5knQtDrt9tan8bGVwS3eBdWSR43wHnLeSWbGEAcu7cOeULMX4VGZV3oO6MYvxaUWEgxiMKn5086AiRnA527txpTBYcxVJ3RWEAorwoxq8iY/oOss5OviQEJR3K0xvy899fDne7AyHIA6XB3ukvSPFiGHsyzkaSkqaamghSd0UxfvkiL+VFQeMAf2NoYUtPo6cx0zNqNw7l4MSJEzScOXdehaHAC42c4Tk9kA/f8caFgayx0zentwf/5W+OT5BmRfnF7nw98jKAHVfdEsX45SgvivGryKi8gxOnz6qbgxi/VlQYCr04Smo/I8A2vmxGU0tdgJ2OiutFhbGtdlIQ42qhAkCMR0VG5R2A37pugbo5/nlq/YQdhgJHW5G6zxGVuHeJClBJQYxHYN0GWqVQKgwpM/7qivhDjp9umXsQEFIuBDGu1Rmtd+DFfaDA/jMeWmqmFaWu9y64s5GJIDsdkbVbdsjibQaz+eNvmvFBEbozMKomr1qqnTF9B2U2tEJJugte1GMqfJciH//Oy42LZkETzpg3CG2YqZCBXqgXVHSfeHizCgy59yXTurXn4EabMX0Hgj2L6T5Q5aIeE8R4NGH41dv1CDlEfL1XUYEp8GIWkLaDi5taJ4zdO1D3LVa3cscfb684Us8I8s9zXldNSaKCQeDIC7naO/4O8ibYx2HuzcYpWgi1d9tmfMpBGVgb/OpVT6tnREEbHO3XfIIln2bJKxw0wCXAL3z9GaYTwvsOjN/YMrrvoPAvxINwa3+BDSSVCOTx11vWqpDIkn8pczYHDx50XwO94C5zOAq1PqMWRvEdqD8PYjwc7Gdk10JoOG7e7NGc8GJ7yY6oHrSyeuEC1g0bNhw7FXuyrMfsq9fLmL4DiPFzkMFt97EiS9op0FGChfoKdobdtm1bYRtX8B67YN8A5K1twXHZNhi3d9A3dGFu/qc2B1D6+2c2Pt74+OB9HzMO1oNWzx0Z031MwOsIHntppfcehPgIhx1XxPjVwZi+gz/4xiLj50OCGXvrM1WvwfVykVkXSVmE7oATOPaKSjc1FZcC97zt1MjaAnOGufyiMT1be5ENbzXNZRjFd/CXdy517zv0vNyQQLXQGZe1c2jPiPtuVMqUrfuPsSuu7sd7eyouxfjVwSi+A8I7/tQ9Lc1s/Kn2Xyt/mC3eBdV2LLvpolb12qhkKV+duxxJoT5Etxx1oMjcS/IHwg2XTb69qEUhUYxfHYz6O4ggelL9eRS4209csB1ts4wuqMbuqTOeCS9ElLiuwUVFN641MZ7vACCzeycFIfBFk//2v2ig5wWBld1X1LZ4WAzz+zNu41byEHyskqYI3N2I7uqV+GEYdTE+70D9VeoBUYyfw1d+1NLIsUNKsu4yjv/9wMsMvPtwNnHGkPZtoD8oU9aEvnI+0ugxzuVAkAdKgYt6T2JVISn0EtzhNpUaA8BRHnHhfp7Ro1vegSAPi0NjbqtRPX2KxHKX8rE+YZdN5XQgG6EiWn20Gbt3oJ6acQ2AZyqPVQ15qnQocEd46uKleURojtxmWvE0i7r2VjuCso42Y/QOfu+mkWWdIsYvAB6EXRfLc1GJQOBF38iIP5FExEBsK0veGKgBYYzegXpqFOMXQBb/uE/WTSd7CdZzpNl2IeKShc6xHQXXZVQZ53eADj16RjCg9YlqYthzPFM2jmT3ir0PCA1cuKtNhgKjQMFI3IMHD0qaKkFv+qPKeL6Dqn+tHV4Kh1TxaN0jAE9dowtQZlrt5XX2eCp8XZU+BozROwDqBR
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1527689358",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "attachment",
|
||
|
|
"uuid": "5b0eb08e-fe44-46e9-88f4-c86b0acd0835",
|
||
|
|
"value": "77f4c251004c42b2fec57d9314f....png"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Support Tool",
|
||
|
|
"comment": "DomainTools Iris",
|
||
|
|
"data": "iVBORw0KGgoAAAANSUhEUgAAA8wAAAK5CAIAAAGS1QBpAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAPpPSURBVHhe7P1plOTGeeaL5+f74Z75MOf858M912PZ433RjMbWWB7PHXs8Go61WC65LNMjyTOyZFuyJVKyFpLiIhZTXCQuIsWdFDexWiRFkZTUJJvNbrLZ7M7qlexuNpusfcmqytr3ff0/wBsVhYoEkAASyEJmPr8TnY0IBALIqMgHLwJvRGQ2SQVhdVcUs7pPnTo1HTdTU1NqK1bUFVcVLtWttuJjdXVVbcXNxBYqnnqs6n744osvf34EAdvO6n711VfxeebMmba2NkmJAA53Vnd3dzc+r7zyyp6enr6+Pmxfdtll9p7N66+/HokHDx7ErwEbSzayywtUdEfVVbcTtu5EMav7wMH3JBF+4Rt7Yw/qiuPg+IkPq62EMau7DtFtQqLZFvk/Eeq6unt7eyF0Fy7kUNczM+dVapLUY3W3trbic3l5WbaF+fl5e2ey1Et1w8gZHR2V7cXFRdlALeMTd1rZ6OjosJMTpEaq2+vOKfWocTZhXfto5jBPJycnJZootVDdxeaKUctgdnZWbTkYGbEeNUChUCg+JAmqvrqdda2r24nxuC+SbQA90a070Xqv5eou1gdnVcr2wMAAPrXIDA0NyUZC1JSYfHHPG5IyPj4uG058mu3a2praSpgauVVq9A3QIIidJ38P52fs1E519/f3q60ijPukbvtGnUr3WaJUZXVf9L3Dt+zfrinYFfh01p2WF2x3dXVJYkm0cCfUtEH1VbeuSgS50Rn8/rcPOPOo1C1CVWXs9V5l1f3RO4/4VKXgzCB5ck3W18zY5DZzdkpDa+sTVu6dyA8FaJM8Xqqsuu9+tcOoymKWVtdL5vGChqCJT1XqzpD7D3cWZ5iamlJb3ujW7aSzs1NtlU31VbcPQaRW/6mMP4bQ09OjtpKhiqs72k3Pv7qB1y7/owJSU607CLrWEP7xh6c2W7J2cq65saG5Mevci1RtsDvTZVc0qru6IxhqPrXm3GXsNXY1N8LGadAyj4jaKkUVV7fz+6skt7f+xV2vxiGa3/nWS7pAnUHeOTjT9a4IJFvd+n1rErh+/2KNvuwn5yQlCPqo2w+YrjV6l4pHIsHq1m+4C3saYGKp1JgYnlnS31+qINvUYP2o880QYmwYezU++uO6Cz+XCJLlRYLVPTFhveGO8VoNvCoUfPiO1429eJTMWX916wnT/vMjYUcLcPUNiv3iK6HdydX44y09Pznd7+qlZVR3BJwdhHHZ4xW6VSb64tXLaa24rl3/8Nm9F/onFlTEZmFhRzRGKlTdSdPb26u2Qv6Y9C/A+YdxLUHyjM6W8BL1p0aq2+fdgg+6oiUgxestmjPbg68H7UAvpkaqG5Rs1MWa84fX73fWo08JzmwIKhV3W/v2G5zdqe65uTm1FR9hndDX19fx6VqJxTiz+ef0Z9dadyiFDYj457sS1s7b2NiQDf1is/y6BrspJrHXuC4wSMn+ebDXte+7THZZu2M3EEUi/EHLlbrWTdigs7tXGvIHbjyokmKidm6VgmubdSZiW6LORE1xh5Skx0WtVbcT/S5NA3GXCi32LXbWvrO6EQot8jbZqqtspmGrizwKNVjduuKKXddcHSWMZo4nJmddq9SYSFd1w0D8zr53VaQ8UIny7KNrM4iHpkbq+rq9F1Q8JtJV3f/5plecbaqhyfoVRwB1t7q66lQMw89YV257e7tsVIbUiYmzutEejUYXCn3s1NSU3paNmZkZiVaYKtNuPK0E/AMgG8jn8/iUJowNfHq5yFaGqr9V4n4o9VgM0sWVBxteeSpM1Vd3MWNjY6hcESWtSymhBqtb+PgdO+66KaEGq9upG7ur1MXUVHUPDw+rrbRSs2KysrIiG4ODg7KRBmq2usuZ8iY5qru6vd7BGyTtRhycaq3ulNjRYUmwusVjTUXiI1pFV7hvxIvEqxsPHUdv+WAsfRTB32altu3vjpisra2hRnze5AL9WBjXo0oa/gbp0u7+/n5UCmy4ew6VHmFWjaT0Vvn+682hqNaMXC3ZbGNzw55CWGcaza438JRWNzCqOzipFW6Q3uoGqOi/vj/meeZ294+R6uquPeqxunexgddadadZuEGtVXfAaY52669Sv9otNs/kvOqnrQx1Wt1S1xJUUkWoneqWunv2jUCjRnRdS8g0/XzTHo0plOMF6E+NVLez7lSSL878lXzlVoPVjaBaqT0zgHwa6PllEFSSPXq+2Gk2Xuq0dfuzvr7uOvFj+dRCdcOqe2tgKsbqdpLP59VWHFR9dXsN+Igdp6m+tBRR7mtETCrJ9ktBa3aJcFRrde/iw/p2dYenKqu7YgISOxSTilJN1Z3y3r4gVE11Bxmfmn4oJhUlvdU9MrJvevpMDQiIk/RWt7a3mhsjujmkkCqo7lqC2l1RWN0VhdVdUVjdlYN1XTnMupbF1+MloVXn1RVXD5Vo1wktyo1iJ2xUUupRdX3xxX8nG4Isyv61r31NojfeeKNsRMNZ17IA/JVXXilRWQYeIF2ikn78+PHFxcWnn35aogay3ny11nWisF0LZl3Lk1u8Qb+ijTeoK46D9XWXFUJjpxLtOuVIg8BGtiXZrpi6rutWG13XSVN3dT0+Pi7+ULr/FhsxrqXlQ73Uta5ZINtS4zKC1rk3OWqhru851PHepv0qshNYk2rLRo/Edq3cpBdbrfq6LrZMXGehd6pEcRvXJOouUVN1ravbidFa9SK3xbWcxOzsTmqqri/63mGVauNc1ULw0WW9Kzkn7hrUEODqieqsaJni1bmQs+wVqSle+SwWauHeCPTP33VOYjzQj42NqcjuUSN1DbymLgk7w5Q08CS0uyrr2ikXoFhhtaoUC7ROKZ6bxsgc+4LNVVbXuhIResbmXSdXdOZBUKlFzM/Pq60t9PiahAztKq5rox51qzTy5PAlM1aPUrax+Yp9Yw2ZTHN+M5vJNjeaI/KKfwTxUjt1rd8zODPkOkrfEl2fX/QycU5bpUyqrK6bj20va6CSioAQS4arnntLJRXhNL2dQ/OSW4kPVOW9ERSv6iHoZ3HDkChWGIkC52viRKfFrNa6dsUpuMFvm057Q9L7xq3bplNb/mPTPuch0ajiujZuZYg6J1R0Pjpqo1DqSwekwCa/6I5Thc0Cbpj/6lN7//UX1K6+iR1Wij4EQSWFp0batbzhdT4cuk5k+Yc3HiyuNa0bzl2yV56PitOxJ5PJZJsamhutFaCbGwNVY7XW9djs8s4vb+JlwLUOWXfOq396XsUdOXWBEiQRjM2ai2xHI8G6fuv8l6anz6hI3Di/vOv399pV/DSo63p6caX4KOwFxekRSLCu9TvTyMsC+aC/vLMKrN+19YvOuu71Qte1KzH2+VWirpPgH354Slflrfu3K0teeuldEqxJW+x5MB9qnWtobM405ayZMbcw6rq46v3/GMGpVr0WPvL9I0a7E4kw69oXVOXIyIiK2N6jaituqruuBVc3s4AVDf78e6+orS2KOw5jWUGkcnWd3HoQrm+tYP8Zf4NiJxD993D+SbwUw8gWgYq267iEr5jikvGMXtxraqArWtej14TrRrZoVFpDDIeNuHD2OIvPwtra2urqqqR44axBuxLVmx3jF1CULSK7oNcJjTjXTdvVP8T1J/XH333VtQadt0rwnX3v6mxGzlDUwr1RCCVQzm5Co2YNpF+FdW0ScFFyZ8epz1+o3t83+uNVccUWiOA1wKn8JuzK7td1ErZg5CYJ60VXdOzVnYp2HUpq/ZGiIlg7egHm4rrGM31zfhMP9w17CgiISs6wpEVDErIFgX4ZJu8V/Z8AcRnFdR0XKdJrsQVfby/3adj1VyKJXj8g/BmclmgSFQ3SdW+M/RuKcMtDvKuVUsmVJFNd12iGrn0dJcGBzvdhMjTWiVcDT5R01XVJUEf+jx4a/b5RmrNIxK5UsabK6roYVJ/r7Q51jV3d3d3Q4oQmZA5L1dd1MahiCIjIkdfTyq5Qg3UtGNKfBm
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1527689358",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "attachment",
|
||
|
|
"uuid": "5b0eb08e-d564-4358-80f0-c86b0acd0835",
|
||
|
|
"value": "aa3875b3f9cbde32f2e1a59c72f....png"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|