adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/596f75c0-9118-4b4c-958b-1921950d210f.json

825 lines
25 KiB
JSON
Raw Normal View History

chg: [feed] added
2023-04-21 13:25:09 +00:00
{
"Event": {
"analysis": "2",
"date": "2017-07-19",
"extends_uuid": "",
"info": "OSINT - Recent Winnti Infrastructure and Samples",
"publish_timestamp": "1500477162",
"published": true,
"threat_level_id": "3",
"timestamp": "1500477123",
"uuid": "596f75c0-9118-4b4c-958b-1921950d210f",
"Orgc": {
"name": "CIRCL",
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
},
"Tag": [
{
"colour": "#ffffff",
chg: [export] updated
2023-05-19 09:05:37 +00:00
"local": "0",
"name": "tlp:white",
"relationship_type": ""
chg: [feed] added
2023-04-21 13:25:09 +00:00
},
{
"colour": "#064800",
chg: [export] updated
2023-05-19 09:05:37 +00:00
"local": "0",
"name": "misp-galaxy:tool=\"Winnti\"",
"relationship_type": ""
chg: [feed] added
2023-04-21 13:25:09 +00:00
}
],
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": false,
"type": "text",
"uuid": "596f75fd-3e14-4f9c-9b22-4f12950d210f",
"value": "On July 17, 2017, we detected a malicious document in VirusTotal exploiting CVE-2017-0199. By pivoting off of the infrastructure we learned that it is related to Winnti, a Chinese threat actor that is mostly targeting the gaming industry. Below we outline initial findings.\r\n\r\nThe malicious file, named curriculum vitae.rtf (58c66b3ddbc0df9810119bb688ea8fb0) was uploaded from Turkey."
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": false,
"type": "link",
"uuid": "596f7608-a51c-4471-a7cb-1921950d210f",
"value": "http://www.clearskysec.com/winnti/"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-5e38-4179-b38d-463a950d210f",
"value": "mess.googlerenewals.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-b8d4-4a5f-acd2-49a5950d210f",
"value": "us.igooglefiles.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-7f48-4b52-bb47-41ee950d210f",
"value": "signup.facebooknavigation.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-c40c-4fa3-ba53-417d950d210f",
"value": "bot.new.googlecustomservice.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-92d8-4d90-a228-45d9950d210f",
"value": "jp.googlerenewals.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-f05c-4dd0-81c8-4027950d210f",
"value": "xn--360tmp-k02m.new.googlecustomservice.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-108c-4bae-becc-4d38950d210f",
"value": "cdn.igooglefiles.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-1e60-4a7e-ae6f-4760950d210f",
"value": "xn--360tmp-k02m.tmp.googlecustomservice.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-8030-4219-bd9f-419c950d210f",
"value": "xn--360tmp-k02m.www.googlecustomservice.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-24cc-4a79-92c8-440d950d210f",
"value": "ftp.googlecustomservice.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-bd8c-4e40-8c39-4184950d210f",
"value": "game.googlecustomservice.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-6e60-4fb8-b145-4321950d210f",
"value": "www.googlecustomservice.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-7fb0-4462-b7cf-4530950d210f",
"value": "new.googlecustomservice.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-4258-4a32-b4de-4c83950d210f",
"value": "bot.googlecustomservice.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-35f8-44f9-b173-4c59950d210f",
"value": "vnew.googlecustomservice.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-baa8-4903-bb46-4c4f950d210f",
"value": "tmp.googlecustomservice.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-8544-4b5b-811b-4d83950d210f",
"value": "xn--360tmp-k02m.googlecustomservice.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-890c-430f-8d55-42a0950d210f",
"value": "hk.uk.igooglefiles.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-91e8-4f75-90ce-4843950d210f",
"value": "us.uk.igooglefiles.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-7a58-447d-85a5-4448950d210f",
"value": "www.uk.igooglefiles.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-24ac-48ff-87ec-4577950d210f",
"value": "lead1.uk.igooglefiles.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-0c14-4477-885a-4d1d950d210f",
"value": "cdn.uk.igooglefiles.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-ae98-4e9c-be52-4804950d210f",
"value": "show.uk.igooglefiles.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-709c-4400-af3d-4b21950d210f",
"value": "uk.uk.igooglefiles.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-4520-40e3-9e85-41c6950d210f",
"value": "news.googlesoftservice.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-1af4-435b-ad98-4f37950d210f",
"value": "news.facebooknavigation.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-acd0-4d76-8ecb-4c27950d210f",
"value": "backup.aolonline.cc"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-3a3c-4cfd-bdc3-4e75950d210f",
"value": "uk.igooglefiles.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "hostname",
"uuid": "596f7628-77f8-454e-a5c0-4b68950d210f",
"value": "news.aolonline.cc"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": false,
"type": "filename",
"uuid": "596f763e-d9b8-440f-ba05-4ae7950d210f",
"value": "NSLS.dll"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": false,
"type": "filename",
"uuid": "596f763e-4da4-44fd-b644-449a950d210f",
"value": "HelpPane.exe"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": false,
"type": "filename",
"uuid": "596f763e-554c-4b80-ad04-4572950d210f",
"value": "conf.exe"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": false,
"type": "filename",
"uuid": "596f763e-cff8-44b0-b491-43c7950d210f",
"value": "msimain17.sdb"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": false,
"type": "filename",
"uuid": "596f763e-f29c-4421-81d1-4cc3950d210f",
"value": "shell.exe"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": false,
"type": "filename",
"uuid": "596f763e-8a94-4675-8f54-4ee2950d210f",
"value": "715578187~.exe"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": false,
"type": "filename",
"uuid": "596f763e-fab4-4bc1-a5a6-4901950d210f",
"value": "COMSysAppLauncher.exe"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": false,
"type": "filename",
"uuid": "596f763e-8adc-473a-903d-4aaf950d210f",
"value": "SysAppLauncher.dll"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": false,
"type": "filename",
"uuid": "596f763e-af34-4d5f-bff2-4ff1950d210f",
"value": "curriculumvitae.rtf"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": false,
"type": "filename",
"uuid": "596f763e-4e74-408a-8298-446f950d210f",
"value": "cryptbase.exe"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": false,
"type": "filename",
"uuid": "596f763e-0868-42fc-a1ba-4c9c950d210f",
"value": "sign.exe"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": false,
"type": "filename",
"uuid": "596f763e-b320-4b8f-a99f-4f04950d210f",
"value": "mess.exe"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": false,
"type": "filename",
"uuid": "596f763e-3e98-4782-8f8a-462e950d210f",
"value": "cryptbasesvc.dll"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": false,
"type": "filename",
"uuid": "596f763e-8e68-4af1-b6fc-49ff950d210f",
"value": "video(20170201)_2.exe"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": false,
"type": "filename",
"uuid": "596f763e-9f78-4939-ac5d-4f93950d210f",
"value": "cryptbase.dll"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": false,
"type": "filename",
"uuid": "596f763e-3854-402a-b7cd-4f9f950d210f",
"value": "COMSystemApplicationLauncher.dll"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "email-src",
"uuid": "596f7651-3758-4e1a-b72f-15a4950d210f",
"value": "yytxconnecticut@gmail.com"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "email-src",
"uuid": "596f7651-8224-492c-9b12-15a4950d210f",
"value": "sunware1@aol.com"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "email-src",
"uuid": "596f7651-85c8-4ac5-a5a0-15a4950d210f",
"value": "lileminnesota@hotmail.com"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "email-src",
"uuid": "596f7651-7244-45b8-ae61-15a4950d210f",
"value": "dsfsaf@gmail.com"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "email-src",
"uuid": "596f7651-19dc-4af7-bfe1-15a4950d210f",
"value": "13836469977@139.com"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "email-src",
"uuid": "596f7651-7098-4c31-9b45-15a4950d210f",
"value": "fuckccddeefff@gmail.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "domain",
"uuid": "596f765b-cc6c-4409-96e0-15a4950d210f",
"value": "googlesoftservice.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "domain",
"uuid": "596f765b-1e9c-4018-aa04-15a4950d210f",
"value": "igooglefiles.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "domain",
"uuid": "596f765b-f4f0-4766-875b-15a4950d210f",
"value": "aolonline.cc"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "domain",
"uuid": "596f765b-d0e0-4dfe-abdb-15a4950d210f",
"value": "facebooknavigation.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "domain",
"uuid": "596f765b-0518-420c-99ba-15a4950d210f",
"value": "googlecustomservice.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "domain",
"uuid": "596f765b-15c4-4914-bcd1-15a4950d210f",
"value": "find2find.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "domain",
"uuid": "596f765b-b334-4d4d-9991-15a4950d210f",
"value": "tiwwter.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "domain",
"uuid": "596f765b-13b4-4ddd-abc8-15a4950d210f",
"value": "luckhairs.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "domain",
"uuid": "596f765b-8050-4069-8070-15a4950d210f",
"value": "googlerenewals.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "domain",
"uuid": "596f765b-7ab8-43ee-a96e-15a4950d210f",
"value": "pornsee.tv"
},
{
"category": "Payload delivery",
"comment": "curriculum vitae.rtf",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "md5",
"uuid": "596f7674-ceb4-4a2a-9cdb-4309950d210f",
"value": "58c66b3ddbc0df9810119bb688ea8fb0"
},
{
"category": "Payload delivery",
"comment": "The script downloads and runs an executable (a4b2a6883ba0451429df29506a1f6995)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "md5",
"uuid": "596f768c-8644-4678-9cac-4702950d210f",
"value": "a4b2a6883ba0451429df29506a1f6995"
},
{
"category": "Network activity",
"comment": "The script downloads and runs an executable (a4b2a6883ba0451429df29506a1f6995) from",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477123",
"to_ids": true,
"type": "url",
"uuid": "596f76b0-64f8-4079-8b95-19ef950d210f",
"value": "http://54.245.195.101/shell.exe"
},
{
"category": "Payload delivery",
"comment": "The script downloads and runs an executable (a4b2a6883ba0451429df29506a1f6995) - Xchecked via VT: a4b2a6883ba0451429df29506a1f6995",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477124",
"to_ids": true,
"type": "sha256",
"uuid": "596f76c4-cc14-4cc2-a849-442402de0b81",
"value": "eee4b1c4621b0ca355dc677652dfd6449f1f230565da8cb5db59fa195e8f553f"
},
{
"category": "Payload delivery",
"comment": "The script downloads and runs an executable (a4b2a6883ba0451429df29506a1f6995) - Xchecked via VT: a4b2a6883ba0451429df29506a1f6995",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477124",
"to_ids": true,
"type": "sha1",
"uuid": "596f76c4-eff0-416f-8c82-4b0f02de0b81",
"value": "79daceed3c07eaeac39c69b5c40e03cedcaaaced"
},
{
"category": "External analysis",
"comment": "The script downloads and runs an executable (a4b2a6883ba0451429df29506a1f6995) - Xchecked via VT: a4b2a6883ba0451429df29506a1f6995",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477124",
"to_ids": false,
"type": "link",
"uuid": "596f76c4-8b78-4bbf-8807-49d202de0b81",
"value": "https://www.virustotal.com/file/eee4b1c4621b0ca355dc677652dfd6449f1f230565da8cb5db59fa195e8f553f/analysis/1500457177/"
},
{
"category": "Payload delivery",
"comment": "curriculum vitae.rtf - Xchecked via VT: 58c66b3ddbc0df9810119bb688ea8fb0",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477124",
"to_ids": true,
"type": "sha256",
"uuid": "596f76c4-ddd0-4ed9-8610-472f02de0b81",
"value": "1ada845dbf89024f4eee8409880ce21ece2262db3ad5129d2eed33a76d177d39"
},
{
"category": "Payload delivery",
"comment": "curriculum vitae.rtf - Xchecked via VT: 58c66b3ddbc0df9810119bb688ea8fb0",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477124",
"to_ids": true,
"type": "sha1",
"uuid": "596f76c4-7164-4eae-9ee1-486802de0b81",
"value": "5486fd254451d90f2f6acdbfa3330444f98dde68"
},
{
"category": "External analysis",
"comment": "curriculum vitae.rtf - Xchecked via VT: 58c66b3ddbc0df9810119bb688ea8fb0",
"deleted": false,
"disable_correlation": false,
"timestamp": "1500477124",
"to_ids": false,
"type": "link",
"uuid": "596f76c4-0bc0-4aac-89f4-4dae02de0b81",
"value": "https://www.virustotal.com/file/1ada845dbf89024f4eee8409880ce21ece2262db3ad5129d2eed33a76d177d39/analysis/1500445510/"
}
]
}
}
Reference in a new issue Copy permalink