adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/5c00e9b7-50ac-4aa7-b893-4a63950d210f.json

765 lines
24 KiB
JSON
Raw Normal View History

chg: [feed] added
2023-04-21 13:25:09 +00:00
{
"Event": {
"analysis": "2",
"date": "2018-11-29",
"extends_uuid": "",
"info": "OSINT - Hancitor active again yith new macro - IoCs",
"publish_timestamp": "1543579828",
"published": true,
"threat_level_id": "3",
"timestamp": "1543579806",
"uuid": "5c00e9b7-50ac-4aa7-b893-4a63950d210f",
"Orgc": {
"name": "CIRCL",
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
},
"Tag": [
{
"colour": "#0c9200",
"name": "misp-galaxy:tool=\"Hancitor\""
},
{
"colour": "#0088cc",
"name": "misp-galaxy:malpedia=\"Hancitor\""
},
{
"colour": "#ffffff",
"name": "tlp:white"
},
{
"colour": "#002642",
"name": "osint:source-type=\"microblog-post\""
}
],
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543566479",
"to_ids": false,
"type": "link",
"uuid": "5c00f48f-3d78-42e6-aebb-4eee950d210f",
"value": "https://ghostbin.com/paste/z6sox/raw"
},
{
"category": "Network activity",
"comment": "Delivery domains",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543566706",
"to_ids": true,
"type": "domain",
"uuid": "5c00f572-aefc-49bc-b505-4203950d210f",
"value": "appersonpropertiesinc.com"
},
{
"category": "Network activity",
"comment": "Delivery domains",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543566707",
"to_ids": true,
"type": "domain",
"uuid": "5c00f573-9208-4fc5-a5d4-45fc950d210f",
"value": "g-cals.com"
},
{
"category": "Network activity",
"comment": "Delivery domains",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543566707",
"to_ids": true,
"type": "domain",
"uuid": "5c00f573-095c-4d84-800e-4858950d210f",
"value": "honeyhillfarmspop.com"
},
{
"category": "Network activity",
"comment": "Delivery domains",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543566708",
"to_ids": true,
"type": "domain",
"uuid": "5c00f574-ad44-4525-828e-49d1950d210f",
"value": "joincryptofundraiser.com"
},
{
"category": "Network activity",
"comment": "Delivery domains",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543566708",
"to_ids": true,
"type": "domain",
"uuid": "5c00f574-0bdc-43d6-afca-4b77950d210f",
"value": "joincrytofundraisernow.net"
},
{
"category": "Network activity",
"comment": "Delivery domains",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543566709",
"to_ids": true,
"type": "domain",
"uuid": "5c00f575-a240-4535-a731-4a0b950d210f",
"value": "joincrytofundraisernow.org"
},
{
"category": "Network activity",
"comment": "Delivery domains",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543566709",
"to_ids": true,
"type": "domain",
"uuid": "5c00f575-d998-42cf-90d3-4cae950d210f",
"value": "joincrytofundraisernow.us"
},
{
"category": "Network activity",
"comment": "Delivery domains",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543566710",
"to_ids": true,
"type": "domain",
"uuid": "5c00f576-ce8c-4d0a-b51e-4b8b950d210f",
"value": "kenapperson.net"
},
{
"category": "Network activity",
"comment": "Delivery domains",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543566710",
"to_ids": true,
"type": "domain",
"uuid": "5c00f576-6140-43bc-8345-4134950d210f",
"value": "localloop-wi.com"
},
{
"category": "Network activity",
"comment": "Delivery domains",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543566711",
"to_ids": true,
"type": "domain",
"uuid": "5c00f577-3104-4a12-b2c4-4d45950d210f",
"value": "localloop-wi.org"
},
{
"category": "Network activity",
"comment": "Delivery domains",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543566711",
"to_ids": true,
"type": "domain",
"uuid": "5c00f577-cbb8-4e3e-976b-45ba950d210f",
"value": "localloopwi.org"
},
{
"category": "Network activity",
"comment": "Delivery domains",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543566711",
"to_ids": true,
"type": "domain",
"uuid": "5c00f577-b704-4b31-bfa8-448e950d210f",
"value": "minaskaowners.com"
},
{
"category": "Network activity",
"comment": "Delivery domains",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543566712",
"to_ids": true,
"type": "domain",
"uuid": "5c00f578-5840-4e81-ab8d-4284950d210f",
"value": "mogamecalls.com"
},
{
"category": "Network activity",
"comment": "Delivery domains",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543566712",
"to_ids": true,
"type": "domain",
"uuid": "5c00f578-165c-41e2-88a8-4cf8950d210f",
"value": "mybabyguam.com"
},
{
"category": "Network activity",
"comment": "Delivery domains",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543566713",
"to_ids": true,
"type": "domain",
"uuid": "5c00f579-e980-40d4-848a-492b950d210f",
"value": "satsumasgeorgia.com"
},
{
"category": "Network activity",
"comment": "Delivery domains",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543566713",
"to_ids": true,
"type": "domain",
"uuid": "5c00f579-e164-4098-916f-4e9f950d210f",
"value": "satsumassales.com"
},
{
"category": "Network activity",
"comment": "Delivery domains",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543566714",
"to_ids": true,
"type": "domain",
"uuid": "5c00f57a-0110-4dd4-a217-4305950d210f",
"value": "satsumasschoolfundraiser.com"
},
{
"category": "Network activity",
"comment": "Delivery domains",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543566714",
"to_ids": true,
"type": "domain",
"uuid": "5c00f57a-b468-4b91-91e2-4441950d210f",
"value": "wilocalloop.com"
},
{
"category": "Network activity",
"comment": "29qni11",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543567512",
"to_ids": true,
"type": "url",
"uuid": "5c00f898-a8e8-4fb0-bf2e-4ed3950d210f",
"value": "http://geeventsehin.com/4/forum.php|http://tonshekinar.ru/4/forum.php|http://fidosofwass.ru/4/forum.php"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543567755",
"to_ids": true,
"type": "url",
"uuid": "5c00f98b-dae8-426f-b451-484e950d210f",
"value": "http://oriton.ru/wp-includes/1"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543567756",
"to_ids": true,
"type": "url",
"uuid": "5c00f98c-b284-4198-9be7-4781950d210f",
"value": "http://arsmarri.ru/wp-content/themes/Helix/1"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543567756",
"to_ids": true,
"type": "url",
"uuid": "5c00f98c-b898-4260-aff4-4f37950d210f",
"value": "http://bigheartstorage.com/wp-admin/includes/1|http://letortedierica.it/wp-admin/includes/1"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543567757",
"to_ids": true,
"type": "url",
"uuid": "5c00f98d-9cfc-4f4b-9cf5-467c950d210f",
"value": "http://bdhsxj.com/wp-content/plugins/wp-no-category-base/1}{b:http://oriton.ru/wp-includes/2"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543567757",
"to_ids": true,
"type": "url",
"uuid": "5c00f98d-2c9c-45b4-b952-40e5950d210f",
"value": "http://arsmarri.ru/wp-content/themes/Helix/2|http://bigheartstorage.com/wp-admin/includes/2"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543567758",
"to_ids": true,
"type": "url",
"uuid": "5c00f98e-9730-4759-b9fa-4fe7950d210f",
"value": "http://letortedierica.it/wp-admin/includes/2|http://bdhsxj.com/wp-content/plugins/wp-no-category-base/2"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543567758",
"to_ids": true,
"type": "url",
"uuid": "5c00f98e-b6ac-4e2c-8dd7-44bd950d210f",
"value": "http://oriton.ru/wp-includes/3|http://arsmarri.ru/wp-content/themes/Helix/3"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543567759",
"to_ids": true,
"type": "url",
"uuid": "5c00f98f-1a6c-439a-b1b3-4214950d210f",
"value": "http://bigheartstorage.com/wp-admin/includes/3|http://letortedierica.it/wp-admin/includes/3"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543567759",
"to_ids": true,
"type": "url",
"uuid": "5c00f98f-d1f4-477b-95c8-401d950d210f",
"value": "http://bdhsxj.com/wp-content/plugins/wp-no-category-base/3"
},
{
"category": "Network activity",
"comment": "Pony MLU",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543568428",
"to_ids": true,
"type": "url",
"uuid": "5c00fc2c-30e0-404d-84fd-4330950d210f",
"value": "http://geeventsehin.com/mlu/forum.php"
},
{
"category": "Network activity",
"comment": "Pony MLU",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543568429",
"to_ids": true,
"type": "url",
"uuid": "5c00fc2d-51ec-48e1-9a2c-452d950d210f",
"value": "http://tonshekinar.ru/mlu/forum.php"
},
{
"category": "Network activity",
"comment": "Pony MLU",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543568429",
"to_ids": true,
"type": "url",
"uuid": "5c00fc2d-b064-4415-ad73-4865950d210f",
"value": "http://fidosofwass.ru/mlu/forum.php"
},
{
"category": "Network activity",
"comment": "Pony D2",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543569342",
"to_ids": true,
"type": "url",
"uuid": "5c00ffbe-990c-4dff-a33a-4de9950d210f",
"value": "http://geeventsehin.com/d2/about.php"
},
{
"category": "Network activity",
"comment": "Pony D2",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543569342",
"to_ids": true,
"type": "url",
"uuid": "5c00ffbe-c144-4fde-8dde-4db9950d210f",
"value": "http://tonshekinar.ru/d2/about.php"
},
{
"category": "Network activity",
"comment": "c2",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543569343",
"to_ids": true,
"type": "url",
"uuid": "5c00ffbf-be1c-433f-91df-4c19950d210f",
"value": "api2.doter.at/webstore"
},
{
"category": "Network activity",
"comment": "c2",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543569343",
"to_ids": true,
"type": "url",
"uuid": "5c00ffbf-ad70-4a08-bd63-48a8950d210f",
"value": "beetfeetlife.bit/webstore"
},
{
"category": "Network activity",
"comment": "c2",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543569344",
"to_ids": true,
"type": "url",
"uuid": "5c00ffc0-b0d0-46d3-878c-48c9950d210f",
"value": "in.extremas.at/webstore"
},
{
"category": "Network activity",
"comment": "c2",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543569344",
"to_ids": true,
"type": "url",
"uuid": "5c00ffc0-aba8-4f83-b640-40a8950d210f",
"value": "asx.zenjom.at/webstore"
},
{
"category": "Network activity",
"comment": "c2",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543569345",
"to_ids": true,
"type": "url",
"uuid": "5c00ffc1-6fa0-400b-b2ab-40ec950d210f",
"value": "g2.ex100p.at/webstore"
},
{
"category": "Network activity",
"comment": "c2",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543569345",
"to_ids": true,
"type": "url",
"uuid": "5c00ffc1-01cc-45a0-b262-44b8950d210f",
"value": "gif.doter.at/webstore"
},
{
"category": "Network activity",
"comment": "c2",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543569346",
"to_ids": true,
"type": "url",
"uuid": "5c00ffc2-a904-44d3-a973-4698950d210f",
"value": "extra.avareg.cn/webstore"
},
{
"category": "Network activity",
"comment": "c2",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543569346",
"to_ids": true,
"type": "url",
"uuid": "5c00ffc2-4110-4b90-ba63-497f950d210f",
"value": "foo.avaregio.at/webstore"
},
{
"category": "Network activity",
"comment": "c2",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543569346",
"to_ids": true,
"type": "url",
"uuid": "5c00ffc2-c930-4f40-8442-45e7950d210f",
"value": "op.iowbased.at/webstore"
},
{
"category": "Network activity",
"comment": "c2",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543569347",
"to_ids": true,
"type": "url",
"uuid": "5c00ffc3-5944-4409-9906-4d39950d210f",
"value": "ws.doter.at/webstore"
},
{
"category": "Network activity",
"comment": "c2",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543569347",
"to_ids": true,
"type": "url",
"uuid": "5c00ffc3-6744-4c15-8e89-4871950d210f",
"value": "f1.cnboal.at/webstore"
},
{
"category": "Network activity",
"comment": "c2",
"deleted": false,
"disable_correlation": false,
"timestamp": "1543569348",
"to_ids": true,
"type": "url",
"uuid": "5c00ffc4-1dd4-42e1-b3b9-46d5950d210f",
"value": "xxx.doolop.at/webstore"
}
],
"Object": [
{
"comment": "",
"deleted": false,
"description": "Microblog post like a Twitter tweet or a post on a Facebook wall.",
"meta-category": "misc",
"name": "microblog",
"template_uuid": "8ec8c911-ddbe-4f5b-895b-fbff70c42a60",
"template_version": "4",
"timestamp": "1543565255",
"uuid": "5c00efc7-b804-4eee-b209-4f07950d210f",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "post",
"timestamp": "1543565256",
"to_ids": false,
"type": "text",
"uuid": "5c00efc8-0df4-432b-b5da-4e45950d210f",
"value": "Hancitor is active again with a new macro. I haven't fully analyzed the macro yet, but here are the IoCs I have so far:\r\n(link: https://ghostbin.com/paste/z6sox/raw) ghostbin.com/paste/z6sox/raw"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "type",
"timestamp": "1543565256",
"to_ids": false,
"type": "text",
"uuid": "5c00efc8-30c4-4a58-ac9c-445d950d210f",
"value": "Twitter"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "url",
"timestamp": "1543565256",
"to_ids": true,
"type": "url",
"uuid": "5c00efc8-85b4-41d7-9c45-4d69950d210f",
"value": "https://mobile.twitter.com/mesa_matt/status/1068180573980631043"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "link",
"timestamp": "1543565257",
"to_ids": true,
"type": "url",
"uuid": "5c00efc9-2d9c-4303-9c75-43a3950d210f",
"value": "ghostbin.com/paste/z6sox/raw"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "creation-date",
"timestamp": "1543565257",
"to_ids": false,
"type": "datetime",
"uuid": "5c00efc9-e678-4354-9c9d-48c9950d210f",
"value": "2018-11-29T17:31:00"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "username",
"timestamp": "1543565258",
"to_ids": false,
"type": "text",
"uuid": "5c00efca-7718-406c-88cf-49f6950d210f",
"value": "Hancitor is active again with a new macro. I haven't fully analyzed the macro yet, but here are the IoCs I have so far:\r\n(link: https://ghostbin.com/paste/z6sox/raw) ghostbin.com/paste/z6sox/raw"
}
]
},
{
"comment": "document",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "15",
"timestamp": "1543567469",
"uuid": "5c00f86d-ee94-4860-ac73-43c3950d210f",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1543567469",
"to_ids": true,
"type": "sha256",
"uuid": "5c00f86d-01ac-4de6-b746-4281950d210f",
"value": "a4276750a825c73f465bf67672b06f19613db82c047f9c0daa7c971c1d231fac"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "state",
"timestamp": "1543567470",
"to_ids": false,
"type": "text",
"uuid": "5c00f86e-fae4-4d1e-b388-4744950d210f",
"value": "Malicious"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "11",
"timestamp": "1543579798",
"uuid": "01bab117-1ff1-45dd-ab99-543bc32c67e3",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1543579798",
"to_ids": true,
"type": "md5",
"uuid": "e7ca7cbf-34cf-44f3-9532-b6bcd731de96",
"value": "9aff54da8d88f6794ce900fd3bf2ad62"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1543579798",
"to_ids": true,
"type": "sha1",
"uuid": "45a37cc2-b6cf-4fa4-b13c-77d774eab636",
"value": "f403fa334c8804020b9a2f1620ca6a251c34827c"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1543579799",
"to_ids": true,
"type": "sha256",
"uuid": "77cb92ef-099b-4f2b-82ff-399a29b6f85e",
"value": "a4276750a825c73f465bf67672b06f19613db82c047f9c0daa7c971c1d231fac"
}
]
},
{
"comment": "",
"deleted": false,
"description": "VirusTotal report",
"meta-category": "misc",
"name": "virustotal-report",
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
"template_version": "2",
"timestamp": "1543579799",
"uuid": "e9b584ea-284f-42cc-b56e-8d9a6aa7ffbb",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "last-submission",
"timestamp": "1543579799",
"to_ids": false,
"type": "datetime",
"uuid": "e8b48c37-59bf-4e42-a194-35e302aa0472",
"value": "2018-11-29T19:57:53"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "permalink",
"timestamp": "1543579800",
"to_ids": false,
"type": "link",
"uuid": "9ca4f760-6bc8-409e-98e5-f580470835eb",
"value": "https://www.virustotal.com/file/a4276750a825c73f465bf67672b06f19613db82c047f9c0daa7c971c1d231fac/analysis/1543521473/"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "detection-ratio",
"timestamp": "1543579800",
"to_ids": false,
"type": "text",
"uuid": "61b7f264-dbce-48b9-ac65-846bc4a535e8",
"value": "10/58"
}
]
}
]
}
}
Reference in a new issue Copy permalink