{
  "Event": {
    "analysis": "2",
    "date": "2014-11-21",
    "extends_uuid": "",
    "info": "OSINT Operation Double Tap from FireEye",
    "publish_timestamp": "1422291233",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1422269529",
    "uuid": "5474459d-1c60-456a-b057-4bdc950d210b",
    "Orgc": {
      "name": "CthulhuSPRL.be",
      "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
    },
    "Tag": [
      {
        "colour": "#004646",
        "name": "type:OSINT"
      },
      {
        "colour": "#33FF00",
        "name": "tlp:green"
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906151",
        "to_ids": false,
        "type": "link",
        "uuid": "547445a7-3164-46d3-9c23-4e61950d210b",
        "value": "https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906179",
        "to_ids": false,
        "type": "text",
        "uuid": "547445c3-5b5c-49a6-a928-45a5950d210b",
        "value": "APT3"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906179",
        "to_ids": false,
        "type": "text",
        "uuid": "547445c3-24b8-4f71-bd6c-4ccd950d210b",
        "value": "UPS"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906179",
        "to_ids": false,
        "type": "text",
        "uuid": "547445c3-eca0-4eda-82aa-493a950d210b",
        "value": "Operation Clandestine Fox"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906179",
        "to_ids": false,
        "type": "text",
        "uuid": "547445c3-7c64-41bb-882f-40b8950d210b",
        "value": "Clandestine Fox"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906204",
        "to_ids": false,
        "type": "comment",
        "uuid": "547445dc-8fa4-48fc-8ba8-9e39950d210b",
        "value": "Data entered by David ANDRE"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906230",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "547445f6-b298-4ea9-93fa-f86d950d210b",
        "value": "CVE-2014-6332"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906230",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "547445f6-e44c-4db8-8e83-f86d950d210b",
        "value": "CVE-2014-4113"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906295",
        "to_ids": true,
        "type": "md5",
        "uuid": "54744638-bbb8-480b-a710-476e950d210b",
        "value": "5a0c4e1925c76a959ab0588f683ab437"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906296",
        "to_ids": true,
        "type": "md5",
        "uuid": "54744638-9f64-4b40-b6b3-476e950d210b",
        "value": "492a839a3bf9c61b7065589a18c5aa8d"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906296",
        "to_ids": true,
        "type": "md5",
        "uuid": "54744638-5f98-4012-a6ed-476e950d210b",
        "value": "744a17a3bc6dbd535f568ef1e87d8b9a"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906296",
        "to_ids": true,
        "type": "md5",
        "uuid": "54744638-10bc-4f77-9945-476e950d210b",
        "value": "5c08957f05377004376e6a622406f9aa"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906360",
        "to_ids": true,
        "type": "pattern-in-file",
        "uuid": "54744678-280c-4a9c-ae2d-4d12950d210b",
        "value": "%USERPROFILE%\\Documents\\Visual Studio 2008\\Projects\\MShell\\Release\\MShell.pdb"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906360",
        "to_ids": true,
        "type": "pattern-in-file",
        "uuid": "54744678-2fd4-45f2-a1a1-49db950d210b",
        "value": "%USERPROFILE%\\Documents\\Visual Studio 2008\\Projects\\4113\\Release\\4113.pdb"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906360",
        "to_ids": true,
        "type": "pattern-in-file",
        "uuid": "54744678-8284-4572-b6ea-4112950d210b",
        "value": "%USERPROFILE%\\Documents\\Visual Studio 2010\\Projects\\MyRat\\Client\\Client\\obj\\x86\\Release\\Client.pdb"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906409",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "547446a9-8200-4d85-b473-4eae950d210b",
        "value": "192.157.198.103"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906409",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "547446a9-90e4-4653-ab99-4ddf950d210b",
        "value": "210.109.99.64"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906409",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "547446a9-409c-428c-ba14-4d62950d210b",
        "value": "192.184.60.229"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906409",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "547446a9-799c-4f23-a52f-4871950d210b",
        "value": "198.55.115.71"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906434",
        "to_ids": true,
        "type": "hostname",
        "uuid": "547446c2-a09c-4a4b-8f91-44a4950d210b",
        "value": "inform.bedircati.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906434",
        "to_ids": true,
        "type": "hostname",
        "uuid": "547446c2-bef4-4f07-88b0-48f5950d210b",
        "value": "pn.lamb-site.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906471",
        "to_ids": true,
        "type": "hostname",
        "uuid": "547446e7-7414-4a27-9505-4d81950d210b",
        "value": "securitywap.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906471",
        "to_ids": true,
        "type": "hostname",
        "uuid": "547446e7-d078-4cbf-9780-49fe950d210b",
        "value": "www.securitywap.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906540",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5474472c-1498-40ec-94a9-402d950d210b",
        "value": "104.151.248.173"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906577",
        "to_ids": true,
        "type": "hostname",
        "uuid": "54744751-3e1c-47e7-b3ba-428b950d210b",
        "value": "join.playboysplus.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906577",
        "to_ids": true,
        "type": "hostname",
        "uuid": "54744751-596c-4935-81e9-4238950d210b",
        "value": "walterclean.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906577",
        "to_ids": true,
        "type": "hostname",
        "uuid": "54744751-2a40-4cad-89da-4e6c950d210b",
        "value": "www.walterclean.com"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906618",
        "to_ids": false,
        "type": "link",
        "uuid": "5474477a-bf40-4c76-8817-476e950d210b",
        "value": "https://github.com/fireeye/iocs/tree/master/APT3"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906742",
        "to_ids": false,
        "type": "text",
        "uuid": "547447f6-e394-440d-9044-4066950d210b",
        "value": "Double Tap"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1416906742",
        "to_ids": false,
        "type": "text",
        "uuid": "547447f6-39d0-4340-8a51-4986950d210b",
        "value": "Operation Double Tap"
      }
    ]
  }
}