2023-04-21 13:25:09 +00:00
{
"Event" : {
"analysis" : "2" ,
"date" : "2015-10-12" ,
"extends_uuid" : "" ,
"info" : "OSINT New Discovery: Ties Between Corebot and Darknet Crypt Service by Damballa" ,
"publish_timestamp" : "1460746491" ,
"published" : true ,
"threat_level_id" : "3" ,
"timestamp" : "1460746480" ,
"uuid" : "561d8626-9214-404c-bc01-4b56950d210b" ,
"Orgc" : {
"name" : "CthulhuSPRL.be" ,
"uuid" : "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
} ,
"Tag" : [
{
"colour" : "#004646" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "type:OSINT" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
} ,
{
"colour" : "#ffffff" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "tlp:white" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
}
] ,
"Attribute" : [
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444775495" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "561d8647-3388-47b8-aad1-102e950d210b" ,
"value" : "https://www.damballa.com/corebot-and-darknet/"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444775504" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "561d8650-ea88-4d5e-90a8-44d0950d210b" ,
"value" : "Corebot"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-7df8-416f-88a0-c74e950d210b" ,
"value" : "mvwjg0knary23je.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-49b0-4cb9-bbdd-c74e950d210b" ,
"value" : "pkdejexati0o4yje.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-4108-4a1a-ad4f-c74e950d210b" ,
"value" : "o4oxqhwfy678y8o.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-ede8-40c4-94f0-c74e950d210b" ,
"value" : "e6a6mjqpapulcfm.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-5d50-4202-81a9-c74e950d210b" ,
"value" : "3narsbobmjm2oho278opyts.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-83ec-4589-b58d-c74e950d210b" ,
"value" : "3duboxe0mr3hef7nkxuj3jq.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-b320-4329-b149-c74e950d210b" ,
"value" : "ihifg8u6etwpc0ktorc.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-4208-4c98-ace2-c74e950d210b" ,
"value" : "q4ydijevkvalgrm4o4a.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-d988-4dde-b1b5-c74e950d210b" ,
"value" : "ypipclqtwtuvkxy.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-7554-45a5-b046-c74e950d210b" ,
"value" : "3jkd5papcfibqjwhipy.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-fa78-4094-8de5-c74e950d210b" ,
"value" : "16qvklkb3b58sfix54kf5lq.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-8dac-473e-9b50-c74e950d210b" ,
"value" : "qd3vkb38ydk814y0kbg.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-d0cc-4f4d-bdce-c74e950d210b" ,
"value" : "kdqjqd5ni0inct1fo2ub38w.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-1770-4d88-ac52-c74e950d210b" ,
"value" : "ex5nah7ponkfq67.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-3d44-4a2b-a962-c74e950d210b" ,
"value" : "m83t7fi27b3ji0qrcxa.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-cbc8-4aa4-b399-c74e950d210b" ,
"value" : "klqvut5puxo6wral1xo.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-5e34-4437-8c09-c74e950d210b" ,
"value" : "wx3nmvo0o03x7pe.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-f4ec-4b9e-bab6-c74e950d210b" ,
"value" : "q0yfy052w2ihkjox1nsp5n3.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-bffc-4c96-b7ad-c74e950d210b" ,
"value" : "yvgxmrurslexuty.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-6014-4b92-bfae-c74e950d210b" ,
"value" : "ehsni4523ro414k.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-d14c-4bd0-86d9-c74e950d210b" ,
"value" : "etsnmxe2gn3hwdq.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-4d10-4ce5-8380-c74e950d210b" ,
"value" : "3tax5vmj3bep18uh5xmr5p5.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-efe4-474f-846f-c74e950d210b" ,
"value" : "yt1ng6583vk8av5rwfy.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-2eb8-4001-bbb7-c74e950d210b" ,
"value" : "oxy0qt16mfsfm23fgvo.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-d9c0-448d-9653-c74e950d210b" ,
"value" : "i8y45hqpcxud7pk2qhq.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-5e80-4178-becb-c74e950d210b" ,
"value" : "ine2gxw4q4klmju.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-021c-4551-a654-c74e950d210b" ,
"value" : "o8s8i0qt74mjwbi.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-aa04-4e4b-adf8-c74e950d210b" ,
"value" : "qtidg8khe4mrwr567na.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-6768-4689-b526-c74e950d210b" ,
"value" : "1rot1ro05p5pc654ktuj74i.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-071c-4173-be14-c74e950d210b" ,
"value" : "wfe23x16e4khat5vgxo0s8s.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-9f64-4d10-ab2f-c74e950d210b" ,
"value" : "1vyrexifwt5rqpwvepm.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-2744-41fb-943a-c74e950d210b" ,
"value" : "aj18k8kjobwxm6g.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-9494-47de-8f98-c74e950d210b" ,
"value" : "qh5datox3r76u8wjqnk.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-0374-4f7d-96a5-c74e950d210b" ,
"value" : "aryfk0e2cpmrynoj1n7b3r5.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-2754-44f8-b36b-c74e950d210b" ,
"value" : "w6ujkjax343r1t3lq4o.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-3b30-4032-9c61-c74e950d210b" ,
"value" : "1x1te0o878iponovyja8m87.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-428c-45c7-9449-c74e950d210b" ,
"value" : "50cr587t3fur5xy6yvw4kxg.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-3b74-4677-9bc6-c74e950d210b" ,
"value" : "wlytono6mjedgl1ro41pcj7.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-345c-4e6d-b816-c74e950d210b" ,
"value" : "eb12yjkt58i07ninkt1.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-32bc-47e1-84b7-c74e950d210b" ,
"value" : "qvc8185616g2ivgf54a.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-2e60-41d8-b82b-c74e950d210b" ,
"value" : "70mdqloho0gjmxo6oxih1tg.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-22fc-4704-a3bb-c74e950d210b" ,
"value" : "ub70705hu0enined52s.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-2fd0-460d-9a58-c74e950d210b" ,
"value" : "ap5todifwjspqp78kxs0e8k.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-2c3c-4881-908a-c74e950d210b" ,
"value" : "srg8sfw2afit1tw.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-1ee4-4e21-9fdc-c74e950d210b" ,
"value" : "ytq0olsbahc8ujwhuhs6m0a.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-244c-4b63-967f-c74e950d210b" ,
"value" : "k2aninsrc0mtqj3.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-13d4-44ab-a97a-c74e950d210b" ,
"value" : "e4w6irqxcj5p78c.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-f8d0-4c13-8964-c74e950d210b" ,
"value" : "e6eti6i4u2wfq83r1nq.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Suspended online shop" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444976095" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "562095df-fb74-46cf-97af-c74e950d210b" ,
"value" : "btcshop.cc"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444976135" ,
"to_ids" : true ,
"type" : "filename|md5" ,
"uuid" : "56209607-4a40-4ec8-aeb4-cc4e950d210b" ,
"value" : "activex.exe|3d6a32b20c66f268b03ec6e8521d6bf3"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444976174" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "5620962e-a298-464e-9d7a-4809950d210b" ,
"value" : "incenzo-bardelli.com/activex/activex.exe"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444976194" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "56209642-bcb8-4a13-9498-d019950d210b" ,
"value" : "177.21.75.140/456/activex.exe"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444976206" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "5620964e-221c-4fe1-88d8-2adb950d210b" ,
"value" : "177.21.75.140"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444976234" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "5620966a-96d8-426e-aece-d029950d210b" ,
"value" : "arijoputane.com/ldr/client.php?family=bank"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444976279" ,
"to_ids" : true ,
"type" : "filename|md5" ,
"uuid" : "56209690-55c0-4b92-ac57-d029950d210b" ,
"value" : "poc.exe|3d6a32b20c66f268b03ec6e8521d6bf3"
} ,
{
"category" : "Network activity" ,
"comment" : "We\u00e2\u20ac\u2122ve been monitoring the btcshop[.]cc infrastructure and its IP address in Poland \u00e2\u20ac\u201c 46.29.18[.]240." ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444976347" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "562096db-7088-44c0-a313-c7cc950d210b" ,
"value" : "46.29.18.240"
} ,
{
"category" : "Attribution" ,
"comment" : "Email registrant whois" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1460746417" ,
"to_ids" : false ,
"type" : "whois-registrant-email" ,
"uuid" : "56209710-51dc-4b96-96d7-d037950d210b" ,
"value" : "drake.lampado777@gmail.com"
} ,
{
"category" : "Attribution" ,
"comment" : "Email registrant whois" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1460746480" ,
"to_ids" : false ,
"type" : "whois-registrant-email" ,
"uuid" : "56209711-57e4-4b59-bd01-d037950d210b" ,
"value" : "ismir.faruh@vfemail.net"
} ,
{
"category" : "Attribution" ,
"comment" : "Email registrant whois" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1460746467" ,
"to_ids" : false ,
"type" : "whois-registrant-email" ,
"uuid" : "56209711-c024-44a4-9fb6-d037950d210b" ,
"value" : "mant@teleworm.us"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-e8bc-4cd4-babb-c74e950d210b" ,
"value" : "qfwd7x38abyje0mrormjyd5.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444975956" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "56209554-b83c-4561-a5ae-c74e950d210b" ,
"value" : "i6shm0u0o2yhopu8ip1d5f3.ddns.net"
} ,
{
"category" : "Network activity" ,
"comment" : "The cybercriminals have also created a Darknet version to ensure they can still operate if the web version is taken down:" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444976460" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "5620974c-9548-4858-9197-4cf7950d210b" ,
"value" : "biwvi4oeyo4fflzr.onion"
} ,
{
"category" : "Network activity" ,
"comment" : "The domain names associated to this Online Crypter service are:" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444976510" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "5620977e-2010-4191-9021-c7cc950d210b" ,
"value" : "cfud.biz"
} ,
{
"category" : "Network activity" ,
"comment" : "The domain names associated to this Online Crypter service are:" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444976510" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "5620977e-ce50-4007-a577-c7cc950d210b" ,
"value" : "apyicrypt.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444976565" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "562097b5-145c-476e-b74e-d06a950d210b" ,
"value" : "vincenzo-bardelli.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444976565" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "562097b5-73c4-4be4-b4dd-d06a950d210b" ,
"value" : "0xdead.com"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1444976576" ,
"to_ids" : false ,
"type" : "comment" ,
"uuid" : "562097c0-2068-4c5d-9614-d471950d210b" ,
"value" : "We\u00e2\u20ac\u2122ve recently discussed Corebot malware and its possible ties to btcshop[.]cc, a site selling stolen data.\r\nToday, we have discovered more pieces of the puzzle: two more Corebot samples and an online crypt service."
}
]
}
}
