adulau/misp-circl-feed
1
0
Fork 0
Code Issues Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/7cf90d8d-61f0-4e36-8083-15f66e3556ad.json

1853 lines
407 KiB
JSON
Raw Normal View History

chg: [feeds] updated
2024-12-27 11:52:46 +01:00
{
"Event": {
"analysis": "2",
"date": "2024-12-16",
"extends_uuid": "",
"info": "OSINT - Lookout Discovers Two Russian Android Spyware Families from Gamaredon APT",
"publish_timestamp": "1734383041",
"published": true,
"threat_level_id": "3",
"timestamp": "1734382956",
"uuid": "7cf90d8d-61f0-4e36-8083-15f66e3556ad",
"Orgc": {
"name": "CIRCL",
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
},
"Tag": [
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:country=\"russia\"",
"relationship_type": "attributed-to"
},
{
"colour": "#0088cc",
"local": false,
"name": "misp-galaxy:threat-actor=\"Gamaredon Group\"",
"relationship_type": "attributed-to"
},
{
"colour": "#004646",
"local": false,
"name": "type:OSINT",
"relationship_type": ""
},
{
"colour": "#0071c3",
"local": false,
"name": "osint:lifetime=\"perpetual\"",
"relationship_type": ""
},
{
"colour": "#0087e8",
"local": false,
"name": "osint:certainty=\"50\"",
"relationship_type": ""
},
{
"colour": "#ffffff",
"local": false,
"name": "tlp:white",
"relationship_type": ""
},
{
"colour": "#ffffff",
"local": false,
"name": "tlp:clear",
"relationship_type": ""
}
],
"Attribute": [
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734347618",
"to_ids": true,
"type": "hostname",
"uuid": "2a3cbf4b-0547-442a-8a81-a707bf76375d",
"value": "llkeyvost.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734347618",
"to_ids": true,
"type": "hostname",
"uuid": "1efbc29a-2358-4e7d-ad16-627a107d97d1",
"value": "fiordmoss.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734347618",
"to_ids": true,
"type": "hostname",
"uuid": "241468ed-be4b-43c8-b6bf-0d75b66bfc85",
"value": "winterknowing.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734347618",
"to_ids": true,
"type": "hostname",
"uuid": "fe56dac5-88bb-4f0a-9f36-4bacb924b495",
"value": "weeklyoptional.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734347618",
"to_ids": true,
"type": "hostname",
"uuid": "422e40f2-940f-4b2a-acc7-8b08005f6286",
"value": "ltkwark.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734347618",
"to_ids": true,
"type": "domain",
"uuid": "3653db53-a8e4-416e-b25d-10479f36cbf6",
"value": "ollymap.pw"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734347618",
"to_ids": true,
"type": "domain",
"uuid": "4c5b281e-c0df-4e2b-bdd3-4361d4d4f12c",
"value": "wleak.pw"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734347618",
"to_ids": true,
"type": "domain",
"uuid": "051989ae-b4c5-4e90-9e9d-11a18d2c45fe",
"value": "goos.pw"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351295",
"to_ids": true,
"type": "sha256",
"uuid": "d6bc21e8-af66-4b6a-8fd2-a4f52c0ec288",
"value": "2c7827f92a103db1b299f334043fbdc73805bbee11f4bfac195f672ba0464d22"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351295",
"to_ids": true,
"type": "sha256",
"uuid": "85df81f4-e2f1-415d-8336-394f9d87e55a",
"value": "114d2a25bb4c296f8ef5bfca4e8192b5aca9b169099ac6291139e68cfc7e37dc"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351295",
"to_ids": true,
"type": "sha256",
"uuid": "b24e38c7-cdff-4cfe-9dbf-91535bfd2f75",
"value": "8af63d7aa2142701116207f61e3e01c9e0239731e5bbbdf79114889b56ca46ea"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351295",
"to_ids": true,
"type": "sha256",
"uuid": "9d1fc8b3-c8c0-4262-9112-934bd2b4da19",
"value": "ce6e5838f3ada452b64ffc6261e9bf74479bd31e83f77c7409c89564846db6a3"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351295",
"to_ids": true,
"type": "sha256",
"uuid": "87a24b96-acb3-4eb3-b267-f5520185d508",
"value": "8407fed605805f0e7ef9628767d0aff1014e7231549b09f3c0d0cb723f07c48a"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351295",
"to_ids": true,
"type": "sha256",
"uuid": "f080cefc-5992-4978-b418-12f0d6c5e1f7",
"value": "cb648ba5cce810e5ba17b89ca2c346bd3f0ad612834c225ec7b55871c4acc085"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351295",
"to_ids": true,
"type": "sha256",
"uuid": "4d0535b4-d2c2-45d9-913f-866a1c8dac44",
"value": "39cb17cb03a794e69eb4f0694e90e41a8cfb8480b82da82fcbd4a88dfe49930d"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351295",
"to_ids": true,
"type": "sha256",
"uuid": "45573158-2d1f-4c05-b7b0-9e92bd449a5d",
"value": "fd5fa718a7411b18845b76d7007db6b4431b1a2ce2f8b2cc047c0fff7c46161f"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351295",
"to_ids": true,
"type": "sha256",
"uuid": "6b8511a9-c14a-42f8-9e16-250bdf5fe516",
"value": "f0acf9558b7a4fcdaa119731ad5fb5bbdf5a704c9be9e929735a4679735989db"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351295",
"to_ids": true,
"type": "sha256",
"uuid": "cfbb294e-d3bc-47aa-b821-8c7fe4d841cd",
"value": "7de055018723b612dfa66a90c83a69afce7db918fb7fa88619833557c4fc61c3"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351295",
"to_ids": true,
"type": "sha256",
"uuid": "4f002b52-bcdf-4ad6-afac-937a519ef091",
"value": "551b8917f57c5cf8cd0a34c1d500db1dd4aed8ec8f31d28a5fabc4720e5b89a3"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351295",
"to_ids": true,
"type": "sha256",
"uuid": "010404a8-b080-43e5-99bc-87aa032efc7b",
"value": "533ff7ba5eb5329cb860486a952259a4dfc0d74654831eb08dbcadc1ae5ca333"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351295",
"to_ids": true,
"type": "sha256",
"uuid": "ef45812f-379b-4fdb-a42c-c3b9752dc848",
"value": "acede5fa46e09803adf9de5e731ca690dc7b02b69a63bacd4836429d289ec4f0"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351296",
"to_ids": true,
"type": "sha256",
"uuid": "ce211a52-7096-4201-b26f-a06e2f7be0ac",
"value": "a3b0c178ab5e6e4b3442d358a78df7409461fa48f6ca8e63b730b0a455a89b18"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351296",
"to_ids": true,
"type": "sha256",
"uuid": "6cfa124d-0db6-4610-8e86-16a507ad4c14",
"value": "7a8ec25f3d4a5c6b4fbdb1002ce22ff0352ce65c0f4ddc9567458e8fcb964845"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351296",
"to_ids": true,
"type": "sha256",
"uuid": "928659e9-d158-4b40-a69e-4577e772cd08",
"value": "86e51f1cc8213e173e47080ab45577e922e624006954de73ebae531589c912f4"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351296",
"to_ids": true,
"type": "sha256",
"uuid": "8ade369a-f546-4c01-b8b7-19d52a095896",
"value": "2ef72c67cf76e8162f5e4bf0a743ac4ed756e153593c430cedf2043a310b24e8"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351296",
"to_ids": true,
"type": "sha256",
"uuid": "78e5183a-1ea1-498b-9dc2-c2f38deb20d7",
"value": "5b7b5a2995c102121695225797f12f0b860500150472126b3b465b51ccad07bd"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351296",
"to_ids": true,
"type": "sha256",
"uuid": "bae9bf15-bf26-4586-b5c0-93a0c01a5499",
"value": "9dd73c9caa547358b6fe5acddf59443d7bf0ffc5b92867e9b67edd5bb2a9f786"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351296",
"to_ids": true,
"type": "sha256",
"uuid": "f769db70-334e-4d3e-b822-2deb0ddd4d12",
"value": "3b5794ca6051740fff6e1b449db06f169df2749f81aaf4c329e18b12afb9a5c7"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351296",
"to_ids": true,
"type": "sha256",
"uuid": "084a22fb-e2c1-4e63-acce-fadeef01c49c",
"value": "dfaa47ed20021c4f84bf68820a618f9e8a2e077d36b6d7281e8724b2124c7825"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351296",
"to_ids": true,
"type": "sha256",
"uuid": "fef0a6b9-81af-4f1a-be47-a73679a136f6",
"value": "f948b650bdc63cf9b1781d651974a9c54d2b2981d3bf4b882f48c3a406272470"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351296",
"to_ids": true,
"type": "sha256",
"uuid": "f36cb96b-68d0-4199-96ba-44fbeca35bb9",
"value": "c82f0a1546bf7025993f2e7da33d1a741d91c78b01268a2d44afa31e66eb2fe8"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351296",
"to_ids": true,
"type": "sha256",
"uuid": "0d938d1c-dc36-4e8f-b57c-890607b0eb4c",
"value": "de3a0b30b8976da933fe6bf88e6e7ab2386a967ada2599ef1dc1b12100a37694"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351296",
"to_ids": true,
"type": "sha256",
"uuid": "64356b1c-445b-4be3-8199-37cfa2a27f8f",
"value": "bd65dbd61f27a90c0770d5f8cc02cfa7d9552f0fb300868611d69972b42d3f1c"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351296",
"to_ids": true,
"type": "sha256",
"uuid": "cdc781d8-c0c7-48b1-8310-de2a4d2dc832",
"value": "bed2cf8758d86daaf25475cc6ed1c71fd3f9a922247c42fe246f8542c76d8c15"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351296",
"to_ids": true,
"type": "sha256",
"uuid": "6c39f7af-dcbf-455c-bd51-87b59529a8b6",
"value": "255996e1aa2a7514b167d9c940d7c8ff3c34393e97e43bda319eb92ea626c4eb"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351296",
"to_ids": true,
"type": "sha256",
"uuid": "c83edb29-cb02-4f99-b6de-f55c63a03af3",
"value": "46b10de13887c36d61517125bec87c4557f325114221291a3ac7142cbc15de29"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351296",
"to_ids": true,
"type": "sha256",
"uuid": "45bd37cc-6cd6-4140-917f-50fdeb1ce564",
"value": "6bfdc285dee8ae3e3dade52a34f5d178163e4a08904b651ff5c906e78ddccec0"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351296",
"to_ids": true,
"type": "sha256",
"uuid": "c64d7beb-532a-4c77-8fbf-e868bf944a78",
"value": "e0c5656ca9877b37e92f5208caf9c65365e9d35ea6eb351915eb3efee235db31"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351296",
"to_ids": true,
"type": "sha256",
"uuid": "055e0c96-6348-498e-ad53-90ce34dd8fcf",
"value": "30429e95b9318816709e23488c77e364a294b6f5f7e3ee414a6a2bef74620ca6"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351296",
"to_ids": true,
"type": "sha256",
"uuid": "38b08594-33f3-411b-a48a-380f11ee3ec7",
"value": "278c9819583ce64913882d425c1d7634307b290709e0143e9268f8f999dacfba"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351296",
"to_ids": true,
"type": "sha256",
"uuid": "d31e7bf2-9805-4a6d-845a-f6e148bb8cc4",
"value": "3a4fa698536111f377030a5d794851d2e23b18d67e6d440ce883b9906d65037d"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351296",
"to_ids": true,
"type": "sha256",
"uuid": "ca1c5d86-613a-4389-a452-78db56f74979",
"value": "629ca39d2c90ff8b343ba1f4cfae11bbc2f61ca6bae80bd093f22efbcf4e4770"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351296",
"to_ids": true,
"type": "sha256",
"uuid": "e45730e1-d193-4736-a5f4-b4366c82a37c",
"value": "633875ce353391ea8bd4c92d8f3f57a525ff0abf9eba8d78528de616b1ee7118"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734351296",
"to_ids": true,
"type": "sha256",
"uuid": "ac811922-9686-4a06-9bb3-a8e59c028647",
"value": "eadd9c3e3f7a1c5e008ca157cb850aa72d283f702da2ab4daf0e4af4d926ab3e"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "ip-dst",
"uuid": "7433d380-2860-425e-9d00-7c94d24462d5",
"value": "194.87.216.136"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "ip-dst",
"uuid": "8368b207-54b7-42a7-9df7-728cc55aa8e2",
"value": "34.98.99.30"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "f432e955-2d33-4e0b-a350-95ec72a03062",
"value": "waltermanage.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "ip-dst",
"uuid": "391d1796-40cb-493c-ac74-ea00ccf82489",
"value": "185.247.184.63"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "39121211-29cf-49b5-ac5d-2c1c5cd48022",
"value": "tokyoprepared.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "ip-dst",
"uuid": "29f36a8a-249d-4246-9bec-89344be74858",
"value": "195.133.88.3"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "5b3f58cf-5f42-4f45-8bcf-a3e47bb30f02",
"value": "tacticsnovelty.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "ip-dst",
"uuid": "880a0c61-6dd5-4da4-bee4-84e8102f2222",
"value": "89.185.84.46"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "4ccca9b8-fb10-4bc3-ab89-8d630509969f",
"value": "sonic-needed.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "ip-dst",
"uuid": "a4f338e0-028b-4c81-bb14-815ccddd4816",
"value": "212.192.14.34"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "bab18bb7-0553-47d0-b41b-4b1c2d676d1e",
"value": "warrantiesford.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "ip-dst",
"uuid": "628b26aa-ad82-460d-9ee4-acdf61c6a599",
"value": "194.87.31.3"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "d15670b3-bb2a-403f-8a85-e14474bff9bd",
"value": "threateningdealer.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "ip-dst",
"uuid": "308e76e5-4647-47f4-b8d8-67728d940e38",
"value": "89.185.84.81"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "2d61fd2b-fd07-40a3-bdc1-98f15703d687",
"value": "twentymicrophone.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "c7a3910a-6f60-4fc0-8276-19374c213c9c",
"value": "slopepainting.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "23a59a34-f768-4545-af8a-b5f4de0f548c",
"value": "rogermayor.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "a2e3cab1-eed4-45ea-95c3-9e718ecb703b",
"value": "stocksharbour.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "cd912603-287f-4937-af2c-971cf5d5baf2",
"value": "wivespassed.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "a42eeed1-ae73-47d0-88fd-6bbf3ea337dd",
"value": "savageprozac.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "0bcd2e68-a3df-4aee-8fcf-457ed33fdefd",
"value": "rhythmfunky.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "e6911eaa-0a31-4c7f-8d10-cfc7be7ab366",
"value": "sauce-patio.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "6fa8a725-27a2-4734-a292-e6892c5580e5",
"value": "skinpublishing.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "697b231b-d1ba-4559-9c7c-5becc4b89f11",
"value": "yields-drew.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "d123b340-4080-4688-a56b-84366e7adef0",
"value": "inspiredflow.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "domain",
"uuid": "72c1158c-8139-4015-bc16-86ae12c99939",
"value": "rakinal.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "domain",
"uuid": "479653ac-d7db-4af0-9427-c3100b3f00e0",
"value": "sabipro.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "3ffa22cf-4804-4b9a-bc2a-4d9245a2a764",
"value": "roomsecuador.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "9fcca7a0-0caf-4fb2-8156-af8235de40e0",
"value": "savagelouisiana.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "7ddeb9a3-6727-4ec7-9cca-0296f9e69f24",
"value": "walletdimension.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "589fe53b-9efa-4079-a997-862ccb64a04d",
"value": "whiteeligible.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "36070e39-3cbf-4119-b750-d52369b15b9c",
"value": "wenticdss.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "304a440a-8ef2-44bb-8384-09b1c2e3af44",
"value": "spoken-object.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "db9cad03-7f64-44ab-9558-97370e5e7bb2",
"value": "spreadingearning.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "cb37178b-7c88-4668-983c-fddd3a7f81a8",
"value": "televisionshandle.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "bcdc4736-38fd-493d-90c5-a543c35e9b7b",
"value": "tongue-forms.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "36c155ae-c65d-4257-b6ad-41c389597849",
"value": "throwingcoupons.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "6a54afef-452d-4ab7-89cc-a271c702ac2d",
"value": "shakecostume.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "41a9568d-24db-4e8e-aa38-3f26fedb76e4",
"value": "tabs-iowa.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "70ee491e-bf01-4e73-ad33-83e912a09d63",
"value": "saferexpansys.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "f8988c66-590a-4c04-8303-ca0209dbdceb",
"value": "stringscrap.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "3b3c5a18-7c60-4e06-a3ed-60bfd9420b21",
"value": "sony-high.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "81e56ca5-9991-458e-afbe-fa6fd70f00cb",
"value": "seasonalfamily.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "6c5f9ff0-c759-4fe3-9020-97ee415da789",
"value": "soilentirely.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382718",
"to_ids": true,
"type": "hostname",
"uuid": "d04e3e3d-929b-49fc-8198-2da404acd8b6",
"value": "seeklemon.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "hostname",
"uuid": "ba0f1d48-842c-4ac6-9457-477fb25c8750",
"value": "spacesknowledge.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "hostname",
"uuid": "6bbd18e0-3fd1-4124-a4f2-e35329ecd802",
"value": "rendercounting.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "hostname",
"uuid": "6d214ccb-f27d-44e3-92da-252e50e9049b",
"value": "regimapessive.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "hostname",
"uuid": "adc4ce5b-fcd0-49a5-bb3c-3b9d8a9be53c",
"value": "standardfebruary.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "hostname",
"uuid": "739932bf-18e3-4447-a785-f6bf8168c1ed",
"value": "towerextraordinary.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "hostname",
"uuid": "10501b15-bb32-4ee8-977b-d1cc5b6be2d0",
"value": "ruleglance.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "hostname",
"uuid": "08fe1269-dbfb-4d87-a6eb-2e6bf9220958",
"value": "twistedfaces.ddns.net"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "6183f436-d0c0-489e-912a-a04790d282a8",
"value": "vasifgo.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "603e411e-f9cf-4a8a-b89f-7ca03b44e7f8",
"value": "baloglandi.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "cfdcd030-4a66-4502-b99f-1c1112cde3fd",
"value": "bucks0.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "98a61f88-de94-4acf-b2f5-810e89b77797",
"value": "bashardi.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "e024592d-e245-46ab-af73-df6d39adbdf6",
"value": "detroit0.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "c5a798b8-b1ad-40b3-af4c-06c9e09b9738",
"value": "lopert0.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "b814fb6e-f665-4a9f-b405-65e4d20a49d5",
"value": "dowrang.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "02b9e4f1-3cc8-4637-9665-1a196eb965a2",
"value": "hitrovana.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "69e987e6-a7ce-4ffc-8360-254f2601bd02",
"value": "molotras.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "f1517ceb-f404-447f-a595-07726745c385",
"value": "milashto.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "6ddd5a63-058c-4733-8435-d43b95e6cf42",
"value": "quyenz0.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "81acf70b-7b41-49bb-84a2-03f00ee1af3b",
"value": "drivento.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "2a61f7ac-0684-4756-8184-7f37ac5f03d5",
"value": "ihsnal.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "02fdc69a-66c2-483d-868a-503bf23df1b4",
"value": "antropa.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "f787b0fc-520f-4245-85f3-96aed1a8aaaa",
"value": "ibragim0.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "2944c22c-26d5-4c77-b5cf-deb002608c58",
"value": "witchdors.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "d9126436-9b1e-4427-a218-fc1b7d4e806d",
"value": "cavaliers0.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "08a3b247-040a-4b32-b2f2-107a8c49b786",
"value": "vilitord.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "97c20788-8716-4c7b-9fbc-912d375696b9",
"value": "phoenix0.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "50263906-95f6-4537-bd41-4c9c56e6825f",
"value": "pistons0.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "be23b00a-6148-42d7-ac8e-80166753fbd4",
"value": "makdart.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "152ba95e-ff6a-4393-97f6-2457ca3777fa",
"value": "bishotent.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "34a2b19f-caa0-437f-836e-f05499277afb",
"value": "forensit.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "0c9e15fb-5032-4f52-afed-ce0b22a8a8ac",
"value": "hornets0.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "46c7b705-2d28-4f7b-9911-f464fc0e240a",
"value": "miltras.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "945e47da-ff3a-4e2b-ba99-b2b1fbc98bb3",
"value": "flashik0.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "3dc093d3-1839-43e3-9e41-67f2f71118cf",
"value": "vipertos.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "8e15c842-efd7-4a7d-bacc-76c7584bfec0",
"value": "batterlas.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "5e179092-4c98-4662-ba6e-f2673a073f64",
"value": "snipotas.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "df315935-0286-4b1e-8d2b-76c39bf07724",
"value": "bartop1.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "48dda3bd-7fce-4ed4-8ef3-f1fa59e82479",
"value": "exportan.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "c9585b74-2c7c-41af-9887-c85ead7b2859",
"value": "chromat0.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "a82638c4-5434-42c1-95f9-5c7964d242ab",
"value": "volnaps.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "aa04ea3d-5e35-4ba7-b4bb-a8f8c0d1b5f8",
"value": "bilodon.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "60954e84-8e45-43fd-b0c0-6aba666773d3",
"value": "silentar.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "25975dd3-54d0-43dd-9108-4d9d12be5a9e",
"value": "intigm.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "13567a66-a34c-4541-b6ff-18e306861179",
"value": "skymagra.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "0c15e873-2007-421f-9d63-2445579cee55",
"value": "gayad0.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "17571a28-a508-44de-954c-1be467b418e5",
"value": "vezirgo.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "16c9d33d-acf4-4756-8b10-a40e77431018",
"value": "savit1.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "7e66a959-22cb-4780-af9b-6f0daefb3b14",
"value": "tilofol.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "1733b6bb-130e-4bb3-a446-9b3d58d38db2",
"value": "kramatl.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "fa525819-83ef-4d22-aeb5-44cba227630a",
"value": "plumbum0.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "d5d90182-2008-4beb-81fc-873f49e309c6",
"value": "ziyaft.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "39472063-5423-4000-bc99-c0090482243d",
"value": "hydrargyrumo.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "cc8fba4b-8b5e-4b7a-ae2f-ce734d12c9d2",
"value": "aghsinsa.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "866070b0-d3db-4108-9d72-4c922fa8aaa0",
"value": "hersopa.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382719",
"to_ids": true,
"type": "domain",
"uuid": "0a7a12cc-91c4-421f-91ea-34944f92fcb2",
"value": "kistrop0n.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382720",
"to_ids": true,
"type": "domain",
"uuid": "c3e8d444-de14-4e22-aba1-3d9ea5c556f5",
"value": "militrar.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382720",
"to_ids": true,
"type": "domain",
"uuid": "be77f791-73a1-43fd-ba49-e5516ff2aa57",
"value": "minhzo.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382720",
"to_ids": true,
"type": "domain",
"uuid": "a4818855-340d-4a7d-b3d6-f54045596ea3",
"value": "kaelos.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382720",
"to_ids": true,
"type": "domain",
"uuid": "150465cb-abed-4e38-bc8f-c6c9928be219",
"value": "lugarto.ru"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1734382720",
"to_ids": true,
"type": "domain",
"uuid": "a629f8f8-70d3-465c-8709-d893a5f5405b",
"value": "cicind.ru"
}
],
"Object": [
{
"comment": "",
"deleted": false,
"description": "Report object to describe a report along with its metadata.",
"meta-category": "misc",
"name": "report",
"template_uuid": "70a68471-df22-4e3f-aa1a-5a3be19f82df",
"template_version": "8",
"timestamp": "1734351365",
"uuid": "b2151afd-6b22-41f4-8f1c-1dfd85f5d61c",
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "link",
"timestamp": "1734351365",
"to_ids": false,
"type": "link",
"uuid": "1a6dd2cb-93b6-4b31-869e-a3cb97ab0aa2",
"value": "https://www.lookout.com/threat-intelligence/article/gamaredon-russian-android-surveillanceware"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "summary",
"timestamp": "1734351365",
"to_ids": false,
"type": "text",
"uuid": "fc16c931-0107-4d3d-b7b8-85af1d751fda",
"value": "Lookout has discovered BoneSpy and PlainGnome Android surveillance families and attributed them to the Russian Gamaredon (Primitive Bear, Shuckworm) APT group associated with the Federal Security Service (FSB).\r\n BoneSpy has been in use since at least 2021, while PlainGnome first appeared in 2024. Both families are still active at the time of writing.\r\n BoneSpy and PlainGnome target former Soviet states and focus on Russian-speaking victims. Lookout assesses this targeting may be related to worsening relations between these countries and Russia since the outbreak of the Ukraine invasion.\r\n Both BoneSpy and PlainGnome collect data such as SMS messages, call logs, phone call audio, photos from device cameras, device location, and contact lists.\r\n PlainGnome acts as a dropper for a surveillance payload, stored within the dropper package, while BoneSpy is deployed as a standalone application."
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "type",
"timestamp": "1734351365",
"to_ids": false,
"type": "text",
"uuid": "58e2abae-cdcf-47d0-b7a5-1b61a94f6763",
"value": "Blog"
}
]
},
{
"comment": "As the blog post was containing images, the IOCs were extracted with OpenAI ChatGPT 4o",
"deleted": false,
"description": "Report object to describe a report along with its metadata.",
"meta-category": "misc",
"name": "report",
"template_uuid": "70a68471-df22-4e3f-aa1a-5a3be19f82df",
"template_version": "8",
"timestamp": "1734382956",
"uuid": "70cf3fcb-f790-4ece-950d-17cf1798dda8",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "title",
"timestamp": "1734382956",
"to_ids": false,
"type": "text",
"uuid": "504a615e-21f7-4171-ba96-3a6fdaaef2a4",
"value": "Extracted IOCs via GPT4o"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "type",
"timestamp": "1734382956",
"to_ids": false,
"type": "text",
"uuid": "720900ac-7426-442a-b236-3a4dd3968fae",
"value": "Blog"
},
{
"category": "External analysis",
"comment": "",
"data": "iVBORw0KGgoAAAANSUhEUgAAAjMAAAEgCAYAAABB+PJqAAAKqWlDQ1BJQ0MgUHJvZmlsZQAASImVlwdQk9kWgO//p4eElhDphN4E6QSQEkILXTrYCEmAUEIMBBW7srgCK4qKCCqCrgoouCpF1oootkVBAfsGWQSUdbFgQ+X9wBDcffPem3dmzpwvJ+eec+6de2fODwBZkSMSpcGKAKQLs8Rhvp70mNg4Om4I4IEiIAA0IHG4mSJmaGggQGTG/l3e9wBo0t61mMz17///V1Hi8TO5AEChCCfwMrnpCJ9G9AVXJM4CAHUA8esvzxJNchvCVDHSIML3JzlpmkcmOWGK0WAqJiKMhTAVADyJwxEnAUCiI356NjcJyUPyQNhKyBMIERYh7JaensFD+ATCJkgM4iNN5mckfJcn6W85E2Q5OZwkGU/vZUrwXoJMURpn5f95HP9b0tMkMzWMECUli/3CEKuMnNn91IwAGQsTgkNmWMCbip/iZIlf5AxzM1lxM8zjeAXI1qYFB85wosCHLcuTxY6YYX6md/gMizPCZLUSxSzmDHPEs3UlqZEyfzKfLcufkxwRPcPZgqjgGc5MDQ+YjWHJ/GJJmKx/vtDXc7auj2zv6Znf7VfAlq3NSo7wk+2dM9s/X8iczZkZI+uNx/fyno2JlMWLsjxltURpobJ4fpqvzJ+ZHS5bm4VcyNm1obIzTOH4h84wYIEMkIaoGNBBIPLLC4As/oqsyY2wMkQrxYKk5Cw6E3lhfDpbyLWcS7exsrEDYPK9Tl+Ht7SpdwjRbsz6NhEBcBVOTEycnfUFfAbgtC4AROmsz7gLAHnk3l/bzpWIs6d9U28JA4hAAVCBGtAG+sAEWAAb4ABcgAfwBv4gBESAWLAEcEEySEc6Xw5Wgw0gDxSAbWAXKAMV4CA4Co6Dk6AJnAWXwFVwE9wB3eARkIIB8BKMgvdgHIIgHESGKJAapAMZQuaQDcSA3CBvKBAKg2KheCgJEkISaDW0CSqAiqEyqBKqhn6BzkCXoOtQJ/QA6oOGoTfQZxgFk2AqrAUbwfNgBsyEA+AIeDGcBC+Dc+BceCtcClfBx+BG+BJ8E+6GpfBLeAwFUHIoGkoXZYFioFioEFQcKhElRq1F5aNKUFWoOlQLqh11FyVFjaA+obFoCpqOtkC7oP3QkWguehl6LboQXYY+im5Et6HvovvQo+hvGDJGE2OOccawMTGYJMxyTB6mBHMY04C5gunGDGDeY7FYGtYY64j1w8ZiU7CrsIXYfdh67EVsJ7YfO4bD4dRw5jhXXAiOg8vC5eH24I7hLuC6cAO4j3g5vA7eBu+Dj8ML8RvxJfga/Hl8F34QP05QJBgSnAkhBB5hJaGIcIjQQrhNGCCME5WIxkRXYgQxhbiBWEqsI14hPia+lZOT05NzklsgJ5BbL1cqd0Lumlyf3CeSMsmMxCItIklIW0lHSBdJD0hvyWSyEdmDHEfOIm8lV5Mvk5+SP8pT5C3l2fI8+XXy5fKN8l3yrxQICoYKTIUlCjkKJQqnFG4rjCgSFI0UWYocxbWK5YpnFHsVx5QoStZKIUrpSoVKNUrXlYaUccpGyt7KPOVc5YPKl5X7KSiKPoVF4VI2UQ5RrlAGqFiqMZVNTaEWUI9TO6ijKsoqdipRKitUylXOqUhpKJoRjU1LoxXRTtJ6aJ/naM1hzuHP2TKnbk7XnA+qGqoeqnzVfNV61W7Vz2p0NW+1VLXtak1qT9TR6mbqC9SXq+9Xv6I+okHVcNHgauRrnNR4qAlrmmmGaa7SPKh5S3NMS1vLV0uktUfrstaINk3bQztFe6f2ee1hHYqOm45AZ6fOBZ0XdBU6k55GL6W30Ud1NXX9dCW6lboduuN6xnqRehv16vWe6BP1GfqJ+jv1W/VHDXQMggxWG9QaPDQkGDIMkw13G7YbfjAyNoo22mzUZDRkrGrMNs4xrjV+bEI2cTdZZlJlcs8Ua8owTTXdZ3rHDDazN0s2Kze7bQ6bO5gLzPeZd87FzHWaK5xbNbfXgmTBtMi2qLXos6RZBlputGyyfDXPYF7cvO3z2ud9s7K3SrM6ZPXIWtna33qjdYv1GxszG65Nuc09W7Ktj+0622bb13bmdny7/Xb37Sn2Qfab7Vvtvzo4Oogd6hyGHQ0c4x33OvYyqIxQRiHjmhPGydNpndNZp0/ODs5Zzied/3KxcEl1qXEZmm88nz//0Px+Vz1Xjmulq9SN7hbvdsBN6q7rznGvcn/moe/B8zjsMcg0ZaYwjzFfeVp5ij0bPD+wnFlrWBe9UF6+XvleHd7K3pHeZd5PffR8knxqfUZ97X1X+V70w/gF+G3362Vrsbnsavaov6P/Gv+2AFJAeEBZwLNAs0BxYEsQHOQftCPocbBhsDC4KQSEsEN2hDwJNQ5dFvrrAuyC0AXlC56HWYetDmsPp4QvDa8Jfx/hGVEU8SjSJFIS2RqlELUoqjrqQ7RXdHG0NGZezJqYm7HqsYLY5jhcXFTc4bixhd4Ldy0cWGS/KG9Rz2LjxSsWX1+iviRtybmlCks5S0/FY+Kj42viv3BCOFWcsQR2wt6EUS6Lu5v7kufB28kb5rvyi/mDia6JxYlDSa5JO5KGk92TS5JHBCxBmeB1il9KRcqH1JDUI6kTadFp9en49Pj0M0JlYaqwLUM7Y0VGp8hclCeSLnNetmvZqDhAfDgTylyc2ZxFRQajWxITyQ+Svmy37PLsj8ujlp9aobRCuOLWSrOVW1YO5vjk/LwKvYq7qnW17uoNq/vWMNdUroXWJqxtXae/LnfdwHrf9Uc3EDekbvhto9XG4o3vNkVvasnVyl2f2/+D7w+1efJ54rzezS6bK35E/yj4sWOL7ZY9W77l8/JvFFgVlBR8KeQW3vjJ+qfSnya2Jm7tKHIo2r8Nu024rWe7+/ajxUrFOcX9O4J2NO6k78zf+W7X0l3XS+xKKnYTd0t2S0sDS5v3GOzZtudLWXJZd7lnef1ezb1b9n7Yx9vXtd9jf12FVkVBxecDggP3K30rG6uMqkoOYg9mH3x+KOpQ+8+Mn6sPqx8uOPz1iPCI9GjY0bZqx+rqGs2aolq4VlI7fGzRsTvHvY4311nUVdbT6gtOgBOSEy9+if+l52TAydZTjFN1pw1P722gNOQ3Qo0rG0ebkpukzbHNnWf8z7S2uLQ0/Gr565GzumfLz6mcKzpPPJ97fuJCzoWxi6KLI5eSLvW3Lm19dDnm8r22BW0dVwKuXLvqc/VyO7P9wjXXa2evO18/c4Nxo+mmw83GW/a3Gn6z/62hw6Gj8bbj7eY7TndaOud3nu9y77p01+vu1Xvseze7g7s7eyJ77vcu6pXe590fepD24PXD7Ifjj9Y/xjzOf6L4pOSp5tOq301/r5c6SM/1efXdehb+7FE/t//lH5l/fBnIfU5+XjKoM1g9ZDN0dthn+M6LhS8GXopejo/k/an0595XJq9O/+Xx163RmNGB1+LXE28K36q9PfLO7l3rWOjY0/fp78c/5H9U+3j0E+NT++foz4Pjy7/gvpR+Nf3a8i3g2+OJ9IkJEUfMmRoFUIjCiYkAvDkCADkWAModZH5YOD1PTwk0/Q0wReA/8fTMPSUOANQhZnIsYl0E4ASiRuuR3IhOjkQRHgC2tZXpzOw7NadPChb5YjngOkndqrz14B8yPcN/1/c/LZjMagf+af8FqcEGdgZEZ90AAABWZVhJZk1NACoAAAAIAAGHaQAEAAAAAQAAABoAAAAAAAOShgAHAAAAEgAAAESgAgAEAAAAAQAAAjOgAwAEAAAAAQAAASAAAAAAQVNDSUkAAABTY3JlZW5zaG90UAym9gAAAdZpVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IlhNUCBDb3JlIDYuMC4wIj4KICAgPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4KICAgICAgPHJkZjpEZXNjcmlwdGlvbi
"deleted": false,
"disable_correlation": false,
"object_relation": "report-file",
"timestamp": "1734382956",
"to_ids": false,
"type": "attachment",
"uuid": "c33bf4ae-5b6f-4c2e-ba92-d824f054cb33",
"value": "67589a71c3f613ce4d7c74ee_67589a5b5ab2144c3b220bec_Screenshot_202024-12-10_20at_202.44.41_E2_80_AFPM.png"
},
{
"category": "External analysis",
"comment": "",
"data": "iVBORw0KGgoAAAANSUhEUgAAAjMAAANdCAYAAABh2/1cAAAKqWlDQ1BJQ0MgUHJvZmlsZQAASImVlwdQk9kWgO//p4eElhDphN4E6QSQEkILXTrYCEmAUEIMBBW7srgCK4qKCCqCrgoouCpF1oootkVBAfsGWQSUdbFgQ+X9wBDcffPem3dmzpwvJ+eec+6de2fODwBZkSMSpcGKAKQLs8Rhvp70mNg4Om4I4IEiIAA0IHG4mSJmaGggQGTG/l3e9wBo0t61mMz17///V1Hi8TO5AEChCCfwMrnpCJ9G9AVXJM4CAHUA8esvzxJNchvCVDHSIML3JzlpmkcmOWGK0WAqJiKMhTAVADyJwxEnAUCiI356NjcJyUPyQNhKyBMIERYh7JaensFD+ATCJkgM4iNN5mckfJcn6W85E2Q5OZwkGU/vZUrwXoJMURpn5f95HP9b0tMkMzWMECUli/3CEKuMnNn91IwAGQsTgkNmWMCbip/iZIlf5AxzM1lxM8zjeAXI1qYFB85wosCHLcuTxY6YYX6md/gMizPCZLUSxSzmDHPEs3UlqZEyfzKfLcufkxwRPcPZgqjgGc5MDQ+YjWHJ/GJJmKx/vtDXc7auj2zv6Znf7VfAlq3NSo7wk+2dM9s/X8iczZkZI+uNx/fyno2JlMWLsjxltURpobJ4fpqvzJ+ZHS5bm4VcyNm1obIzTOH4h84wYIEMkIaoGNBBIPLLC4As/oqsyY2wMkQrxYKk5Cw6E3lhfDpbyLWcS7exsrEDYPK9Tl+Ht7SpdwjRbsz6NhEBcBVOTEycnfUFfAbgtC4AROmsz7gLAHnk3l/bzpWIs6d9U28JA4hAAVCBGtAG+sAEWAAb4ABcgAfwBv4gBESAWLAEcEEySEc6Xw5Wgw0gDxSAbWAXKAMV4CA4Co6Dk6AJnAWXwFVwE9wB3eARkIIB8BKMgvdgHIIgHESGKJAapAMZQuaQDcSA3CBvKBAKg2KheCgJEkISaDW0CSqAiqEyqBKqhn6BzkCXoOtQJ/QA6oOGoTfQZxgFk2AqrAUbwfNgBsyEA+AIeDGcBC+Dc+BceCtcClfBx+BG+BJ8E+6GpfBLeAwFUHIoGkoXZYFioFioEFQcKhElRq1F5aNKUFWoOlQLqh11FyVFjaA+obFoCpqOtkC7oP3QkWguehl6LboQXYY+im5Et6HvovvQo+hvGDJGE2OOccawMTGYJMxyTB6mBHMY04C5gunGDGDeY7FYGtYY64j1w8ZiU7CrsIXYfdh67EVsJ7YfO4bD4dRw5jhXXAiOg8vC5eH24I7hLuC6cAO4j3g5vA7eBu+Dj8ML8RvxJfga/Hl8F34QP05QJBgSnAkhBB5hJaGIcIjQQrhNGCCME5WIxkRXYgQxhbiBWEqsI14hPia+lZOT05NzklsgJ5BbL1cqd0Lumlyf3CeSMsmMxCItIklIW0lHSBdJD0hvyWSyEdmDHEfOIm8lV5Mvk5+SP8pT5C3l2fI8+XXy5fKN8l3yrxQICoYKTIUlCjkKJQqnFG4rjCgSFI0UWYocxbWK5YpnFHsVx5QoStZKIUrpSoVKNUrXlYaUccpGyt7KPOVc5YPKl5X7KSiKPoVF4VI2UQ5RrlAGqFiqMZVNTaEWUI9TO6ijKsoqdipRKitUylXOqUhpKJoRjU1LoxXRTtJ6aJ/naM1hzuHP2TKnbk7XnA+qGqoeqnzVfNV61W7Vz2p0NW+1VLXtak1qT9TR6mbqC9SXq+9Xv6I+okHVcNHgauRrnNR4qAlrmmmGaa7SPKh5S3NMS1vLV0uktUfrstaINk3bQztFe6f2ee1hHYqOm45AZ6fOBZ0XdBU6k55GL6W30Ud1NXX9dCW6lboduuN6xnqRehv16vWe6BP1GfqJ+jv1W/VHDXQMggxWG9QaPDQkGDIMkw13G7YbfjAyNoo22mzUZDRkrGrMNs4xrjV+bEI2cTdZZlJlcs8Ua8owTTXdZ3rHDDazN0s2Kze7bQ6bO5gLzPeZd87FzHWaK5xbNbfXgmTBtMi2qLXos6RZBlputGyyfDXPYF7cvO3z2ud9s7K3SrM6ZPXIWtna33qjdYv1GxszG65Nuc09W7Ktj+0622bb13bmdny7/Xb37Sn2Qfab7Vvtvzo4Oogd6hyGHQ0c4x33OvYyqIxQRiHjmhPGydNpndNZp0/ODs5Zzied/3KxcEl1qXEZmm88nz//0Px+Vz1Xjmulq9SN7hbvdsBN6q7rznGvcn/moe/B8zjsMcg0ZaYwjzFfeVp5ij0bPD+wnFlrWBe9UF6+XvleHd7K3pHeZd5PffR8knxqfUZ97X1X+V70w/gF+G3362Vrsbnsavaov6P/Gv+2AFJAeEBZwLNAs0BxYEsQHOQftCPocbBhsDC4KQSEsEN2hDwJNQ5dFvrrAuyC0AXlC56HWYetDmsPp4QvDa8Jfx/hGVEU8SjSJFIS2RqlELUoqjrqQ7RXdHG0NGZezJqYm7HqsYLY5jhcXFTc4bixhd4Ldy0cWGS/KG9Rz2LjxSsWX1+iviRtybmlCks5S0/FY+Kj42viv3BCOFWcsQR2wt6EUS6Lu5v7kufB28kb5rvyi/mDia6JxYlDSa5JO5KGk92TS5JHBCxBmeB1il9KRcqH1JDUI6kTadFp9en49Pj0M0JlYaqwLUM7Y0VGp8hclCeSLnNetmvZqDhAfDgTylyc2ZxFRQajWxITyQ+Svmy37PLsj8ujlp9aobRCuOLWSrOVW1YO5vjk/LwKvYq7qnW17uoNq/vWMNdUroXWJqxtXae/LnfdwHrf9Uc3EDekbvhto9XG4o3vNkVvasnVyl2f2/+D7w+1efJ54rzezS6bK35E/yj4sWOL7ZY9W77l8/JvFFgVlBR8KeQW3vjJ+qfSnya2Jm7tKHIo2r8Nu024rWe7+/ajxUrFOcX9O4J2NO6k78zf+W7X0l3XS+xKKnYTd0t2S0sDS5v3GOzZtudLWXJZd7lnef1ezb1b9n7Yx9vXtd9jf12FVkVBxecDggP3K30rG6uMqkoOYg9mH3x+KOpQ+8+Mn6sPqx8uOPz1iPCI9GjY0bZqx+rqGs2aolq4VlI7fGzRsTvHvY4311nUVdbT6gtOgBOSEy9+if+l52TAydZTjFN1pw1P722gNOQ3Qo0rG0ebkpukzbHNnWf8z7S2uLQ0/Gr565GzumfLz6mcKzpPPJ97fuJCzoWxi6KLI5eSLvW3Lm19dDnm8r22BW0dVwKuXLvqc/VyO7P9wjXXa2evO18/c4Nxo+mmw83GW/a3Gn6z/62hw6Gj8bbj7eY7TndaOud3nu9y77p01+vu1Xvseze7g7s7eyJ77vcu6pXe590fepD24PXD7Ifjj9Y/xjzOf6L4pOSp5tOq301/r5c6SM/1efXdehb+7FE/t//lH5l/fBnIfU5+XjKoM1g9ZDN0dthn+M6LhS8GXopejo/k/an0595XJq9O/+Xx163RmNGB1+LXE28K36q9PfLO7l3rWOjY0/fp78c/5H9U+3j0E+NT++foz4Pjy7/gvpR+Nf3a8i3g2+OJ9IkJEUfMmRoFUIjCiYkAvDkCADkWAModZH5YOD1PTwk0/Q0wReA/8fTMPSUOANQhZnIsYl0E4ASiRuuR3IhOjkQRHgC2tZXpzOw7NadPChb5YjngOkndqrz14B8yPcN/1/c/LZjMagf+af8FqcEGdgZEZ90AAABWZVhJZk1NACoAAAAIAAGHaQAEAAAAAQAAABoAAAAAAAOShgAHAAAAEgAAAESgAgAEAAAAAQAAAjOgAwAEAAAAAQAAA10AAAAAQVNDSUkAAABTY3JlZW5zaG90FPzxfAAAAdZpVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IlhNUCBDb3JlIDYuMC4wIj4KICAgPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4KICAgICAgPHJkZjpEZXNjcmlwdGlvbi
"deleted": false,
"disable_correlation": false,
"object_relation": "report-file",
"timestamp": "1734382956",
"to_ids": false,
"type": "attachment",
"uuid": "d2fa61fc-1768-47d4-85ad-3880fe283225",
"value": "67589a71c3f613ce4d7c751c_67589a4dea143dc3466b8c8d_Screenshot_202024-12-10_20at_202.44.25_E2_80_AFPM.png"
},
{
"category": "External analysis",
"comment": "",
"data": "iVBORw0KGgoAAAANSUhEUgAAAjMAAAOMCAYAAAC4uTLWAAAKqWlDQ1BJQ0MgUHJvZmlsZQAASImVlwdQk9kWgO//p4eElhDphN4E6QSQEkILXTrYCEmAUEIMBBW7srgCK4qKCCqCrgoouCpF1oootkVBAfsGWQSUdbFgQ+X9wBDcffPem3dmzpwvJ+eec+6de2fODwBZkSMSpcGKAKQLs8Rhvp70mNg4Om4I4IEiIAA0IHG4mSJmaGggQGTG/l3e9wBo0t61mMz17///V1Hi8TO5AEChCCfwMrnpCJ9G9AVXJM4CAHUA8esvzxJNchvCVDHSIML3JzlpmkcmOWGK0WAqJiKMhTAVADyJwxEnAUCiI356NjcJyUPyQNhKyBMIERYh7JaensFD+ATCJkgM4iNN5mckfJcn6W85E2Q5OZwkGU/vZUrwXoJMURpn5f95HP9b0tMkMzWMECUli/3CEKuMnNn91IwAGQsTgkNmWMCbip/iZIlf5AxzM1lxM8zjeAXI1qYFB85wosCHLcuTxY6YYX6md/gMizPCZLUSxSzmDHPEs3UlqZEyfzKfLcufkxwRPcPZgqjgGc5MDQ+YjWHJ/GJJmKx/vtDXc7auj2zv6Znf7VfAlq3NSo7wk+2dM9s/X8iczZkZI+uNx/fyno2JlMWLsjxltURpobJ4fpqvzJ+ZHS5bm4VcyNm1obIzTOH4h84wYIEMkIaoGNBBIPLLC4As/oqsyY2wMkQrxYKk5Cw6E3lhfDpbyLWcS7exsrEDYPK9Tl+Ht7SpdwjRbsz6NhEBcBVOTEycnfUFfAbgtC4AROmsz7gLAHnk3l/bzpWIs6d9U28JA4hAAVCBGtAG+sAEWAAb4ABcgAfwBv4gBESAWLAEcEEySEc6Xw5Wgw0gDxSAbWAXKAMV4CA4Co6Dk6AJnAWXwFVwE9wB3eARkIIB8BKMgvdgHIIgHESGKJAapAMZQuaQDcSA3CBvKBAKg2KheCgJEkISaDW0CSqAiqEyqBKqhn6BzkCXoOtQJ/QA6oOGoTfQZxgFk2AqrAUbwfNgBsyEA+AIeDGcBC+Dc+BceCtcClfBx+BG+BJ8E+6GpfBLeAwFUHIoGkoXZYFioFioEFQcKhElRq1F5aNKUFWoOlQLqh11FyVFjaA+obFoCpqOtkC7oP3QkWguehl6LboQXYY+im5Et6HvovvQo+hvGDJGE2OOccawMTGYJMxyTB6mBHMY04C5gunGDGDeY7FYGtYY64j1w8ZiU7CrsIXYfdh67EVsJ7YfO4bD4dRw5jhXXAiOg8vC5eH24I7hLuC6cAO4j3g5vA7eBu+Dj8ML8RvxJfga/Hl8F34QP05QJBgSnAkhBB5hJaGIcIjQQrhNGCCME5WIxkRXYgQxhbiBWEqsI14hPia+lZOT05NzklsgJ5BbL1cqd0Lumlyf3CeSMsmMxCItIklIW0lHSBdJD0hvyWSyEdmDHEfOIm8lV5Mvk5+SP8pT5C3l2fI8+XXy5fKN8l3yrxQICoYKTIUlCjkKJQqnFG4rjCgSFI0UWYocxbWK5YpnFHsVx5QoStZKIUrpSoVKNUrXlYaUccpGyt7KPOVc5YPKl5X7KSiKPoVF4VI2UQ5RrlAGqFiqMZVNTaEWUI9TO6ijKsoqdipRKitUylXOqUhpKJoRjU1LoxXRTtJ6aJ/naM1hzuHP2TKnbk7XnA+qGqoeqnzVfNV61W7Vz2p0NW+1VLXtak1qT9TR6mbqC9SXq+9Xv6I+okHVcNHgauRrnNR4qAlrmmmGaa7SPKh5S3NMS1vLV0uktUfrstaINk3bQztFe6f2ee1hHYqOm45AZ6fOBZ0XdBU6k55GL6W30Ud1NXX9dCW6lboduuN6xnqRehv16vWe6BP1GfqJ+jv1W/VHDXQMggxWG9QaPDQkGDIMkw13G7YbfjAyNoo22mzUZDRkrGrMNs4xrjV+bEI2cTdZZlJlcs8Ua8owTTXdZ3rHDDazN0s2Kze7bQ6bO5gLzPeZd87FzHWaK5xbNbfXgmTBtMi2qLXos6RZBlputGyyfDXPYF7cvO3z2ud9s7K3SrM6ZPXIWtna33qjdYv1GxszG65Nuc09W7Ktj+0622bb13bmdny7/Xb37Sn2Qfab7Vvtvzo4Oogd6hyGHQ0c4x33OvYyqIxQRiHjmhPGydNpndNZp0/ODs5Zzied/3KxcEl1qXEZmm88nz//0Px+Vz1Xjmulq9SN7hbvdsBN6q7rznGvcn/moe/B8zjsMcg0ZaYwjzFfeVp5ij0bPD+wnFlrWBe9UF6+XvleHd7K3pHeZd5PffR8knxqfUZ97X1X+V70w/gF+G3362Vrsbnsavaov6P/Gv+2AFJAeEBZwLNAs0BxYEsQHOQftCPocbBhsDC4KQSEsEN2hDwJNQ5dFvrrAuyC0AXlC56HWYetDmsPp4QvDa8Jfx/hGVEU8SjSJFIS2RqlELUoqjrqQ7RXdHG0NGZezJqYm7HqsYLY5jhcXFTc4bixhd4Ldy0cWGS/KG9Rz2LjxSsWX1+iviRtybmlCks5S0/FY+Kj42viv3BCOFWcsQR2wt6EUS6Lu5v7kufB28kb5rvyi/mDia6JxYlDSa5JO5KGk92TS5JHBCxBmeB1il9KRcqH1JDUI6kTadFp9en49Pj0M0JlYaqwLUM7Y0VGp8hclCeSLnNetmvZqDhAfDgTylyc2ZxFRQajWxITyQ+Svmy37PLsj8ujlp9aobRCuOLWSrOVW1YO5vjk/LwKvYq7qnW17uoNq/vWMNdUroXWJqxtXae/LnfdwHrf9Uc3EDekbvhto9XG4o3vNkVvasnVyl2f2/+D7w+1efJ54rzezS6bK35E/yj4sWOL7ZY9W77l8/JvFFgVlBR8KeQW3vjJ+qfSnya2Jm7tKHIo2r8Nu024rWe7+/ajxUrFOcX9O4J2NO6k78zf+W7X0l3XS+xKKnYTd0t2S0sDS5v3GOzZtudLWXJZd7lnef1ezb1b9n7Yx9vXtd9jf12FVkVBxecDggP3K30rG6uMqkoOYg9mH3x+KOpQ+8+Mn6sPqx8uOPz1iPCI9GjY0bZqx+rqGs2aolq4VlI7fGzRsTvHvY4311nUVdbT6gtOgBOSEy9+if+l52TAydZTjFN1pw1P722gNOQ3Qo0rG0ebkpukzbHNnWf8z7S2uLQ0/Gr565GzumfLz6mcKzpPPJ97fuJCzoWxi6KLI5eSLvW3Lm19dDnm8r22BW0dVwKuXLvqc/VyO7P9wjXXa2evO18/c4Nxo+mmw83GW/a3Gn6z/62hw6Gj8bbj7eY7TndaOud3nu9y77p01+vu1Xvseze7g7s7eyJ77vcu6pXe590fepD24PXD7Ifjj9Y/xjzOf6L4pOSp5tOq301/r5c6SM/1efXdehb+7FE/t//lH5l/fBnIfU5+XjKoM1g9ZDN0dthn+M6LhS8GXopejo/k/an0595XJq9O/+Xx163RmNGB1+LXE28K36q9PfLO7l3rWOjY0/fp78c/5H9U+3j0E+NT++foz4Pjy7/gvpR+Nf3a8i3g2+OJ9IkJEUfMmRoFUIjCiYkAvDkCADkWAModZH5YOD1PTwk0/Q0wReA/8fTMPSUOANQhZnIsYl0E4ASiRuuR3IhOjkQRHgC2tZXpzOw7NadPChb5YjngOkndqrz14B8yPcN/1/c/LZjMagf+af8FqcEGdgZEZ90AAABWZVhJZk1NACoAAAAIAAGHaQAEAAAAAQAAABoAAAAAAAOShgAHAAAAEgAAAESgAgAEAAAAAQAAAjOgAwAEAAAAAQAAA4wAAAAAQVNDSUkAAABTY3JlZW5zaG90gKO2tAAAAdZpVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IlhNUCBDb3JlIDYuMC4wIj4KICAgPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4KICAgICAgPHJkZjpEZXNjcmlwdGlvbi
"deleted": false,
"disable_correlation": false,
"object_relation": "report-file",
"timestamp": "1734382956",
"to_ids": false,
"type": "attachment",
"uuid": "31cc8814-19bd-4975-8ee8-6c8363aad4ca",
"value": "67589a71c3f613ce4d7c7516_67589a36e09031426f9eb27e_Screenshot_202024-12-10_20at_202.44.12_E2_80_AFPM.png"
},
{
"category": "External analysis",
"comment": "",
"data": "RG9tYWluLElQIEFkZHJlc3MKd2Vla2x5b3B0aW9uYWwuZGRuc1suXW5ldCwxOTQuODcuMjE2Wy5dMTM2Cmdvb3NbLl1wdywzNC45OC45OVsuXTMwCndhbHRlcm1hbmFnZS5kZG5zWy5dbmV0LDE4NS4yNDcuMTg0Wy5dNjMKdG9reW9wcmVwYXJlZC5kZG5zWy5dbmV0LDE5NS4xMzMuODhbLl0zCnRhY3RpY3Nub3ZlbHR5LmRkbnNbLl1uZXQsODkuMTg1Ljg0Wy5dNDYKc29uaWMtbmVlZGVkLmRkbnNbLl1uZXQsMjEyLjE5Mi4xNFsuXTM0CndhcnJhbnRpZXNmb3JkLmRkbnNbLl1uZXQsMTk0Ljg3LjMxWy5dMwp0aHJlYXRlbmluZ2RlYWxlci5kZG5zWy5dbmV0LDg5LjE4NS44NFsuXTgxCnR3ZW50eW1pY3JvcGhvbmUuZGRuc1suXW5ldCwKc2xvcGVwYWludGluZy5kZG5zWy5dbmV0LApyb2dlcm1heW9yLmRkbnNbLl1uZXQsCnN0b2Nrc2hhcmJvdXIuZGRuc1suXW5ldCwKd2l2ZXNwYXNzZWQuZGRuc1suXW5ldCwKc2F2YWdlcHJvemFjLmRkbnNbLl1uZXQsCnJoeXRobWZ1bmt5LmRkbnNbLl1uZXQsCnNhdWNlLXBhdGlvLmRkbnNbLl1uZXQsCnNraW5wdWJsaXNoaW5nLmRkbnNbLl1uZXQsCnlpZWxkcy1kcmV3LmRkbnNbLl1uZXQsCmluc3BpcmVkZmxvdy5kZG5zWy5dbmV0LApmaW9yZG1vc3MuZGRuc1suXW5ldCwKcmFraW5hbFsuXXJ1LApzYWJpcHJvWy5dcnUsCnJvb21zZWN1YWRvci5kZG5zWy5dbmV0LApzYXZhZ2Vsb3Vpc2lhbmEuZGRuc1suXW5ldCwKd2FsbGV0ZGltZW5zaW9uLmRkbnNbLl1uZXQsCndoaXRlZWxpZ2libGUuZGRuc1suXW5ldCwKd2VudGljZHNzLmRkbnNbLl1uZXQsCnNwb2tlbi1vYmplY3QuZGRuc1suXW5ldCwKc3ByZWFkaW5nZWFybmluZy5kZG5zWy5dbmV0LAp0ZWxldmlzaW9uc2hhbmRsZS5kZG5zWy5dbmV0LAp0b25ndWUtZm9ybXMuZGRuc1suXW5ldCwKdGhyb3dpbmdjb3Vwb25zLmRkbnNbLl1uZXQsCnNoYWtlY29zdHVtZS5kZG5zWy5dbmV0LAp0YWJzLWlvd2EuZGRuc1suXW5ldCwKc2FmZXJleHBhbnN5cy5kZG5zWy5dbmV0LApzdHJpbmdzY3JhcC5kZG5zWy5dbmV0LApzb255LWhpZ2guZGRuc1suXW5ldCwKc2Vhc29uYWxmYW1pbHkuZGRuc1suXW5ldCwKc29pbGVudGlyZWx5LmRkbnNbLl1uZXQsCnNlZWtsZW1vbi5kZG5zWy5dbmV0LApzcGFjZXNrbm93bGVkZ2UuZGRuc1suXW5ldCwKcmVuZGVyY291bnRpbmcuZGRuc1suXW5ldCwKcmVnaW1hcGVzc2l2ZS5kZG5zWy5dbmV0LApzdGFuZGFyZGZlYnJ1YXJ5LmRkbnNbLl1uZXQsCnRvd2VyZXh0cmFvcmRpbmFyeS5kZG5zWy5dbmV0LApydWxlZ2xhbmNlLmRkbnNbLl1uZXQsCnR3aXN0ZWRmYWNlcy5kZG5zWy5dbmV0LApsbGtleXZvc3QuZGRuc1suXW5ldCwKdmFzaWZnb1suXXJ1LApiYWxvZ2xhbmRpWy5dcnUsCmJ1Y2tzMFsuXXJ1LApiYXNoYXJkaVsuXXJ1LApkZXRyb2l0MFsuXXJ1LApsb3BlcnQwWy5dcnUsCmRvd3JhbmdbLl1ydSwKaGl0cm92YW5hWy5dcnUsCm1vbG90cmFzWy5dcnUsCm1pbGFzaHRvWy5dcnUsCnF1eWVuejBbLl1ydSwKZHJpdmVudG9bLl1ydSwKaWhzbmFsWy5dcnUsCmFudHJvcGFbLl1ydSwKaWJyYWdpbTBbLl1ydSwKd2l0Y2hkb3JzWy5dcnUsCmNhdmFsaWVyczBbLl1ydSwKdmlsaXRvcmRbLl1ydSwKcGhvZW5peDBbLl1ydSwKcGlzdG9uczBbLl1ydSwKbWFrZGFydFsuXXJ1LApiaXNob3RlbnRbLl1ydSwKZm9yZW5zaXRbLl1ydSwKaG9ybmV0czBbLl1ydSwKbWlsdHJhc1suXXJ1LApmbGFzaGlrMFsuXXJ1LAp2aXBlcnRvc1suXXJ1LApiYXR0ZXJsYXNbLl1ydSwKc25pcG90YXNbLl1ydSwKYmFydG9wMVsuXXJ1LApleHBvcnRhblsuXXJ1LApjaHJvbWF0MFsuXXJ1LAp2b2xuYXBzWy5dcnUsCmJpbG9kb25bLl1ydSwKc2lsZW50YXJbLl1ydSwKaW50aWdtWy5dcnUsCnNreW1hZ3JhWy5dcnUsCmdheWFkMFsuXXJ1LAp2ZXppcmdvWy5dcnUsCnNhdml0MVsuXXJ1LAp0aWxvZm9sWy5dcnUsCmtyYW1hdGxbLl1ydSwKcGx1bWJ1bTBbLl1ydSwKeml5YWZ0Wy5dcnUsCmh5ZHJhcmd5cnVtb1suXXJ1LAphZ2hzaW5zYVsuXXJ1LApoZXJzb3BhWy5dcnUsCmtpc3Ryb3AwblsuXXJ1LAptaWxpdHJhclsuXXJ1LAptaW5oem9bLl1ydSwKa2FlbG9zWy5dcnUsCmx1Z2FydG9bLl1ydSwKY2ljaW5kWy5dcnUsCg==",
"deleted": false,
"disable_correlation": false,
"object_relation": "report-file",
"timestamp": "1734382956",
"to_ids": false,
"type": "attachment",
"uuid": "e9f9eb1f-fe7c-4eab-ad31-48e7af6bb1a1",
"value": "Extracted_IOC_List.csv"
}
]
}
],
"EventReport": [
{
"name": "Report from - https://www.lookout.com/threat-intelligence/article/gamaredon-russian-android-surveillanceware (1734347559)",
"content": "Lookout ResearchThreat GuidancesThreat DataResourcesAbout UsContact UsAndroidSpywareIn\\-Depth AnalysisDecember 11, 2024# Lookout Discovers Two Russian Android Spyware Families from Gamaredon APT\n\n* Lookout has discovered BoneSpy and PlainGnome Android surveillance families and attributed them to the Russian Gamaredon (Primitive Bear, Shuckworm) APT group associated with the Federal Security Service (FSB).\n* BoneSpy has been in use since at least 2021, while PlainGnome first appeared in 2024\\. Both families are still active at the time of writing.\n* BoneSpy and PlainGnome target former Soviet states and focus on Russian\\-speaking victims. Lookout assesses this targeting may be related to worsening relations between these countries and Russia since the outbreak of the Ukraine invasion.\n* Both BoneSpy and PlainGnome collect data such as SMS messages, call logs, phone call audio, photos from device cameras, device location, and contact lists.\n* PlainGnome acts as a dropper for a surveillance payload, stored within the dropper package, while BoneSpy is deployed as a standalone application.\nResearchers at the Lookout Threat Lab have discovered two Android surveillance families dubbed BoneSpy and PlainGnome. They are both attributed to Russia\\-aligned cyber espionage threat group Gamaredon (aka Primitive Bear, Shuckworm). This group was identified as a component of the Russian Federal Security Service (FSB) by the Security Service of Ukraine (SSU) in 2021\\. These are the first known mobile families to be attributed to Gamaredon.\u00c2\u00a0\n\nBoneSpy and PlainGnome appear to target Russian speaking victims across the former Soviet Union in countries including Uzbekistan, Kazakhstan, Tajikistan, and Kyrgyzstan. While Gamaredon has historically targeted Ukraine, the targeting of Central Asian countries like Uzbekistan likely resulted from worsening relations between these countries and Russia since the start of the Russian invasion of Ukraine in 2022\\. Also, while specific targets are difficult to pinpoint, Lookout researchers uncovered an indication of possible enterprise targeting using the BoneSpy family in early 2022\\. While the Gamaredon threat group has long been known to target Ukraine, Lookout has no specific evidence to show BoneSpy or PlainGnome were used against Ukrainian victims.\n\n# Attribution to Gamaredon\n\nLookout researchers attribute BoneSpy and PlainGnome to Gamaredon based on use of IP addresses that point to command and control (C2\\) domains for both the mobile families that were also observed in Gamaredon\u00e2\u0080\u0099s desktop campaigns. We also observed a large number of domains sharing Gamaredon\u00e2\u0080\u0099s known domain naming convention described by MSTIC in April 2023, which were hosted on IP infrastructure shared with dynamic DNS C2 domains in use with the group\u00e2\u0080\u0099s mobile surveillanceware. In addition, Gamaredon has been known to use ddns\\[.]net and other dynamic DNS providers since at least 2017, a consistent technique used by BoneSpy and PlainGnome.\u00c2\u00a0\n\nThese infrastructure connections, together with the evidence of Russian development and targeting of Russian speaking groups in former Soviet states, lead us to the conclusion that both BoneSpy and PlainGnome are operated by Gamaredon.\n\n# App Families Analysis\n\nLookout has tracked BoneSpy since December 2021 and discovered PlainGnome in January 2024\\. BoneSpy is derived from the Russian open\\-source DroidWatcher, a surveillance app developed between 2013 and 2014\\. Conversely, PlainGnome is not based on open\\-source code, but shares similar theming and C2 server properties with BoneSpy. PlainGnome is also a two\\-stage deployment while BoneSpy is a self\\-contained single app. Each of these have broad surveillance capabilities including:\n\n* Attempting to gain root access to the device\n* Anti\\-analysis checks\u00c2\n* Location tracking\n* Getting information about the device\n* Getting sensitive user data such as:some text\n\t+ SMS messages\u00c2\n\t+ ambient audi
"id": "832",
"event_id": "270341",
"timestamp": "1734347559",
"uuid": "9149f7ba-3239-413f-80b3-91370b42c4e8",
"deleted": false
}
]
}
}
Reference in a new issue Copy permalink