{
  "Event": {
    "analysis": "2",
    "date": "2015-10-12",
    "extends_uuid": "",
    "info": "OSINT New Discovery: Ties Between Corebot and Darknet Crypt Service by Damballa",
    "publish_timestamp": "1460746491",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1460746480",
    "uuid": "561d8626-9214-404c-bc01-4b56950d210b",
    "Orgc": {
      "name": "CthulhuSPRL.be",
      "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
    },
    "Tag": [
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444775495",
        "to_ids": false,
        "type": "link",
        "uuid": "561d8647-3388-47b8-aad1-102e950d210b",
        "value": "https://www.damballa.com/corebot-and-darknet/"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444775504",
        "to_ids": false,
        "type": "text",
        "uuid": "561d8650-ea88-4d5e-90a8-44d0950d210b",
        "value": "Corebot"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-7df8-416f-88a0-c74e950d210b",
        "value": "mvwjg0knary23je.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-49b0-4cb9-bbdd-c74e950d210b",
        "value": "pkdejexati0o4yje.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-4108-4a1a-ad4f-c74e950d210b",
        "value": "o4oxqhwfy678y8o.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-ede8-40c4-94f0-c74e950d210b",
        "value": "e6a6mjqpapulcfm.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-5d50-4202-81a9-c74e950d210b",
        "value": "3narsbobmjm2oho278opyts.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-83ec-4589-b58d-c74e950d210b",
        "value": "3duboxe0mr3hef7nkxuj3jq.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-b320-4329-b149-c74e950d210b",
        "value": "ihifg8u6etwpc0ktorc.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-4208-4c98-ace2-c74e950d210b",
        "value": "q4ydijevkvalgrm4o4a.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-d988-4dde-b1b5-c74e950d210b",
        "value": "ypipclqtwtuvkxy.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-7554-45a5-b046-c74e950d210b",
        "value": "3jkd5papcfibqjwhipy.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-fa78-4094-8de5-c74e950d210b",
        "value": "16qvklkb3b58sfix54kf5lq.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-8dac-473e-9b50-c74e950d210b",
        "value": "qd3vkb38ydk814y0kbg.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-d0cc-4f4d-bdce-c74e950d210b",
        "value": "kdqjqd5ni0inct1fo2ub38w.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-1770-4d88-ac52-c74e950d210b",
        "value": "ex5nah7ponkfq67.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-3d44-4a2b-a962-c74e950d210b",
        "value": "m83t7fi27b3ji0qrcxa.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-cbc8-4aa4-b399-c74e950d210b",
        "value": "klqvut5puxo6wral1xo.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-5e34-4437-8c09-c74e950d210b",
        "value": "wx3nmvo0o03x7pe.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-f4ec-4b9e-bab6-c74e950d210b",
        "value": "q0yfy052w2ihkjox1nsp5n3.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-bffc-4c96-b7ad-c74e950d210b",
        "value": "yvgxmrurslexuty.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-6014-4b92-bfae-c74e950d210b",
        "value": "ehsni4523ro414k.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-d14c-4bd0-86d9-c74e950d210b",
        "value": "etsnmxe2gn3hwdq.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-4d10-4ce5-8380-c74e950d210b",
        "value": "3tax5vmj3bep18uh5xmr5p5.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-efe4-474f-846f-c74e950d210b",
        "value": "yt1ng6583vk8av5rwfy.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-2eb8-4001-bbb7-c74e950d210b",
        "value": "oxy0qt16mfsfm23fgvo.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-d9c0-448d-9653-c74e950d210b",
        "value": "i8y45hqpcxud7pk2qhq.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-5e80-4178-becb-c74e950d210b",
        "value": "ine2gxw4q4klmju.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-021c-4551-a654-c74e950d210b",
        "value": "o8s8i0qt74mjwbi.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-aa04-4e4b-adf8-c74e950d210b",
        "value": "qtidg8khe4mrwr567na.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-6768-4689-b526-c74e950d210b",
        "value": "1rot1ro05p5pc654ktuj74i.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-071c-4173-be14-c74e950d210b",
        "value": "wfe23x16e4khat5vgxo0s8s.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-9f64-4d10-ab2f-c74e950d210b",
        "value": "1vyrexifwt5rqpwvepm.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-2744-41fb-943a-c74e950d210b",
        "value": "aj18k8kjobwxm6g.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-9494-47de-8f98-c74e950d210b",
        "value": "qh5datox3r76u8wjqnk.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-0374-4f7d-96a5-c74e950d210b",
        "value": "aryfk0e2cpmrynoj1n7b3r5.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-2754-44f8-b36b-c74e950d210b",
        "value": "w6ujkjax343r1t3lq4o.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-3b30-4032-9c61-c74e950d210b",
        "value": "1x1te0o878iponovyja8m87.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-428c-45c7-9449-c74e950d210b",
        "value": "50cr587t3fur5xy6yvw4kxg.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-3b74-4677-9bc6-c74e950d210b",
        "value": "wlytono6mjedgl1ro41pcj7.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-345c-4e6d-b816-c74e950d210b",
        "value": "eb12yjkt58i07ninkt1.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-32bc-47e1-84b7-c74e950d210b",
        "value": "qvc8185616g2ivgf54a.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-2e60-41d8-b82b-c74e950d210b",
        "value": "70mdqloho0gjmxo6oxih1tg.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-22fc-4704-a3bb-c74e950d210b",
        "value": "ub70705hu0enined52s.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-2fd0-460d-9a58-c74e950d210b",
        "value": "ap5todifwjspqp78kxs0e8k.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-2c3c-4881-908a-c74e950d210b",
        "value": "srg8sfw2afit1tw.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-1ee4-4e21-9fdc-c74e950d210b",
        "value": "ytq0olsbahc8ujwhuhs6m0a.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-244c-4b63-967f-c74e950d210b",
        "value": "k2aninsrc0mtqj3.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-13d4-44ab-a97a-c74e950d210b",
        "value": "e4w6irqxcj5p78c.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-f8d0-4c13-8964-c74e950d210b",
        "value": "e6eti6i4u2wfq83r1nq.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Suspended online shop",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444976095",
        "to_ids": true,
        "type": "domain",
        "uuid": "562095df-fb74-46cf-97af-c74e950d210b",
        "value": "btcshop.cc"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444976135",
        "to_ids": true,
        "type": "filename|md5",
        "uuid": "56209607-4a40-4ec8-aeb4-cc4e950d210b",
        "value": "activex.exe|3d6a32b20c66f268b03ec6e8521d6bf3"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444976174",
        "to_ids": true,
        "type": "url",
        "uuid": "5620962e-a298-464e-9d7a-4809950d210b",
        "value": "incenzo-bardelli.com/activex/activex.exe"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444976194",
        "to_ids": true,
        "type": "url",
        "uuid": "56209642-bcb8-4a13-9498-d019950d210b",
        "value": "177.21.75.140/456/activex.exe"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444976206",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5620964e-221c-4fe1-88d8-2adb950d210b",
        "value": "177.21.75.140"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444976234",
        "to_ids": true,
        "type": "url",
        "uuid": "5620966a-96d8-426e-aece-d029950d210b",
        "value": "arijoputane.com/ldr/client.php?family=bank"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444976279",
        "to_ids": true,
        "type": "filename|md5",
        "uuid": "56209690-55c0-4b92-ac57-d029950d210b",
        "value": "poc.exe|3d6a32b20c66f268b03ec6e8521d6bf3"
      },
      {
        "category": "Network activity",
        "comment": "We\u00e2\u20ac\u2122ve been monitoring the btcshop[.]cc infrastructure and its IP address in Poland \u00e2\u20ac\u201c 46.29.18[.]240.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444976347",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "562096db-7088-44c0-a313-c7cc950d210b",
        "value": "46.29.18.240"
      },
      {
        "category": "Attribution",
        "comment": "Email registrant whois",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1460746417",
        "to_ids": false,
        "type": "whois-registrant-email",
        "uuid": "56209710-51dc-4b96-96d7-d037950d210b",
        "value": "drake.lampado777@gmail.com"
      },
      {
        "category": "Attribution",
        "comment": "Email registrant whois",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1460746480",
        "to_ids": false,
        "type": "whois-registrant-email",
        "uuid": "56209711-57e4-4b59-bd01-d037950d210b",
        "value": "ismir.faruh@vfemail.net"
      },
      {
        "category": "Attribution",
        "comment": "Email registrant whois",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1460746467",
        "to_ids": false,
        "type": "whois-registrant-email",
        "uuid": "56209711-c024-44a4-9fb6-d037950d210b",
        "value": "mant@teleworm.us"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-e8bc-4cd4-babb-c74e950d210b",
        "value": "qfwd7x38abyje0mrormjyd5.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "Domain generated with 3d6a32b20c66f268b03ec6e8521d6bf3 on Sept 21st 2015",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444975956",
        "to_ids": true,
        "type": "hostname",
        "uuid": "56209554-b83c-4561-a5ae-c74e950d210b",
        "value": "i6shm0u0o2yhopu8ip1d5f3.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "The cybercriminals have also created a Darknet version to ensure they can still operate if the web version is taken down:",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444976460",
        "to_ids": true,
        "type": "url",
        "uuid": "5620974c-9548-4858-9197-4cf7950d210b",
        "value": "biwvi4oeyo4fflzr.onion"
      },
      {
        "category": "Network activity",
        "comment": "The domain names associated to this Online Crypter service are:",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444976510",
        "to_ids": true,
        "type": "domain",
        "uuid": "5620977e-2010-4191-9021-c7cc950d210b",
        "value": "cfud.biz"
      },
      {
        "category": "Network activity",
        "comment": "The domain names associated to this Online Crypter service are:",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444976510",
        "to_ids": true,
        "type": "domain",
        "uuid": "5620977e-ce50-4007-a577-c7cc950d210b",
        "value": "apyicrypt.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444976565",
        "to_ids": true,
        "type": "domain",
        "uuid": "562097b5-145c-476e-b74e-d06a950d210b",
        "value": "vincenzo-bardelli.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444976565",
        "to_ids": true,
        "type": "domain",
        "uuid": "562097b5-73c4-4be4-b4dd-d06a950d210b",
        "value": "0xdead.com"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1444976576",
        "to_ids": false,
        "type": "comment",
        "uuid": "562097c0-2068-4c5d-9614-d471950d210b",
        "value": "We\u00e2\u20ac\u2122ve recently discussed Corebot malware and its possible ties to btcshop[.]cc, a site selling stolen data.\r\nToday, we have discovered more pieces of the puzzle: two more Corebot samples and an online crypt service."
      }
    ]
  }
}