{
  "Event": {
    "analysis": "2",
    "date": "2014-11-13",
    "extends_uuid": "",
    "info": "OSINT Roaming tiger by Anton Cherepanov from ESET",
    "publish_timestamp": "1416828334",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1416828155",
    "uuid": "547311c0-3fdc-4968-85fa-058d950d210b",
    "Orgc": {
      "name": "CthulhuSPRL.be",
      "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
    },
    "Tag": [
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#33FF00",
        "local": false,
        "name": "tlp:green",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827403",
        "to_ids": false,
        "type": "link",
        "uuid": "5473120b-b9b4-497d-9208-058d950d210b",
        "value": "http://2014.zeronights.ru/assets/files/slides/roaming_tiger_zeronights_2014.pdf"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827414",
        "to_ids": false,
        "type": "text",
        "uuid": "54731216-6d44-4aa7-81c2-2ddd950d210b",
        "value": "Roaming Tiger"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827433",
        "to_ids": false,
        "type": "comment",
        "uuid": "54731229-549c-4d6b-a110-2ddc950d210b",
        "value": "Data entered by David Andr\u00c3\u00a9"
      },
      {
        "category": "Antivirus detection",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827459",
        "to_ids": false,
        "type": "text",
        "uuid": "54731243-f4bc-4e7f-b8f1-4181950d210b",
        "value": "Win32/Korplug"
      },
      {
        "category": "Antivirus detection",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827459",
        "to_ids": false,
        "type": "text",
        "uuid": "54731243-8eb0-44c6-b2ac-4181950d210b",
        "value": "Win32/Farfli.BE"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827493",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "54731265-fbb4-4308-b03b-141e950d210b",
        "value": "CVE-2012-0158"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827493",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "54731265-f5f0-4204-9c35-141e950d210b",
        "value": "CVE-2014-1761"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827618",
        "to_ids": true,
        "type": "hostname",
        "uuid": "547312e2-7dcc-49a0-b626-2dde950d210b",
        "value": "systemupdate5.dtdns.net"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827618",
        "to_ids": true,
        "type": "hostname",
        "uuid": "547312e2-e0c8-4b44-9234-2dde950d210b",
        "value": "gf.arabidc.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827618",
        "to_ids": true,
        "type": "hostname",
        "uuid": "547312e2-4a14-47c7-884c-2dde950d210b",
        "value": "kkts.yeshopea.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827619",
        "to_ids": true,
        "type": "hostname",
        "uuid": "547312e3-af84-449c-9c0c-2dde950d210b",
        "value": "dwm.dnsedc.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827619",
        "to_ids": true,
        "type": "hostname",
        "uuid": "547312e3-a79c-4124-afb3-2dde950d210b",
        "value": "dotkang.vicp.net"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827619",
        "to_ids": true,
        "type": "hostname",
        "uuid": "547312e3-4fc4-4002-a34f-2dde950d210b",
        "value": "adobeflashupdate.dynu.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827619",
        "to_ids": true,
        "type": "hostname",
        "uuid": "547312e3-e17c-4bb3-b7fb-2dde950d210b",
        "value": "checkpdate.youdontcare.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827619",
        "to_ids": true,
        "type": "hostname",
        "uuid": "547312e3-295c-4761-b412-2dde950d210b",
        "value": "news.bfinancea.net"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827619",
        "to_ids": true,
        "type": "hostname",
        "uuid": "547312e3-4b90-46e3-ba6f-2dde950d210b",
        "value": "fsvts.vicp.net"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827619",
        "to_ids": true,
        "type": "hostname",
        "uuid": "547312e3-041c-4c42-8323-2dde950d210b",
        "value": "nativeame2.jkub.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827619",
        "to_ids": true,
        "type": "hostname",
        "uuid": "547312e3-8690-4c71-aad0-2dde950d210b",
        "value": "futuresgolda.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827619",
        "to_ids": true,
        "type": "hostname",
        "uuid": "547312e3-67f0-40f2-a3d7-2dde950d210b",
        "value": "googlenewsup.net"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827619",
        "to_ids": true,
        "type": "hostname",
        "uuid": "547312e3-7958-468c-ac32-2dde950d210b",
        "value": "csrss.dnsedc.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827641",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "547312f9-b6e8-4518-9ee5-2ddd950d210b",
        "value": "103.225.196.140"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827641",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "547312f9-1350-4c05-ab05-2ddd950d210b",
        "value": "122.10.118.131"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827642",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "547312fa-ac54-49b8-ab2c-2ddd950d210b",
        "value": "122.10.118.129"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827642",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "547312fa-9e50-4f16-b233-2ddd950d210b",
        "value": "122.10.83.51"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827642",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "547312fa-3d38-4921-bc1e-2ddd950d210b",
        "value": "122.10.92.14"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827971",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54731443-49c8-4975-ba47-141e950d210b",
        "value": "122.10.83.62"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827971",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54731443-b0cc-460d-be25-141e950d210b",
        "value": "103.20.222.170"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827972",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54731444-4a34-4692-8f6d-141e950d210b",
        "value": "122.10.92.15"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827972",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54731444-749c-482d-8b65-141e950d210b",
        "value": "122.112.2.14"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827972",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54731444-3f98-46bd-9f72-141e950d210b",
        "value": "123.254.109.166"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827985",
        "to_ids": true,
        "type": "hostname",
        "uuid": "54731451-a114-49f6-89d6-2dde950d210b",
        "value": "adobeupdate1.dtdns.net"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827985",
        "to_ids": true,
        "type": "hostname",
        "uuid": "54731451-67c0-41e4-80a1-2dde950d210b",
        "value": "niisvt.f3322.org"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827985",
        "to_ids": true,
        "type": "hostname",
        "uuid": "54731451-0540-4661-ab6f-2dde950d210b",
        "value": "note.wikaba.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827985",
        "to_ids": true,
        "type": "hostname",
        "uuid": "54731451-1e70-4a99-90c6-2dde950d210b",
        "value": "spacecorp.sizn-ru.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827985",
        "to_ids": true,
        "type": "hostname",
        "uuid": "54731451-fbb8-44c2-87c9-2dde950d210b",
        "value": "systemupdate1.suroot.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827985",
        "to_ids": true,
        "type": "hostname",
        "uuid": "54731451-67d4-4dc6-bed7-2dde950d210b",
        "value": "systemupdate2.etowns.net"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827985",
        "to_ids": true,
        "type": "hostname",
        "uuid": "54731451-0b9c-4818-9d44-2dde950d210b",
        "value": "systemupdate3.suroot.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827985",
        "to_ids": true,
        "type": "hostname",
        "uuid": "54731451-6530-44ab-9a9e-2dde950d210b",
        "value": "transactiona.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827986",
        "to_ids": true,
        "type": "hostname",
        "uuid": "54731452-ba84-4149-92a0-2dde950d210b",
        "value": "vk.newsupdatea.net"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827986",
        "to_ids": true,
        "type": "hostname",
        "uuid": "54731452-de64-44ec-a669-2dde950d210b",
        "value": "www.dnsqaz.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827986",
        "to_ids": true,
        "type": "hostname",
        "uuid": "54731452-701c-4c54-87cf-2dde950d210b",
        "value": "www.sizn-ru.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416827986",
        "to_ids": true,
        "type": "hostname",
        "uuid": "54731452-7178-4492-ba04-2dde950d210b",
        "value": "yahoomessenger.flnet.org"
      },
      {
        "category": "Attribution",
        "comment": "Registrant",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416828155",
        "to_ids": false,
        "type": "text",
        "uuid": "547314fb-1174-486b-a2a5-058e950d210b",
        "value": "yuminga1@126.com"
      }
    ]
  }
}