{ "Event": { "analysis": "2", "date": "2015-02-19", "extends_uuid": "", "info": "Fessleak before It Was Cool by OpenDNS", "publish_timestamp": "1424959199", "published": true, "threat_level_id": "3", "timestamp": "1424959168", "uuid": "54eee0da-d1c8-441e-a760-3839950d210b", "Orgc": { "name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f" }, "Tag": [ { "colour": "#004646", "local": "0", "name": "type:OSINT", "relationship_type": "" }, { "colour": "#33FF00", "local": "0", "name": "tlp:green", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": false, "type": "link", "uuid": "54eee0e4-8894-4718-98d1-0c01950d210b", "value": "http://www.invincea.com/2015/02/fessleak-the-zero-day-driven-advanced-ransomware-malvertising-campaign/" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": false, "type": "text", "uuid": "54eee0f9-5050-48b3-84b0-8bb2950d210b", "value": "Fessleak" }, { "category": "Attribution", "comment": "Registrant", "deleted": false, "disable_correlation": false, "timestamp": "1424941965", "to_ids": false, "type": "text", "uuid": "54eee12f-aaa4-4f61-8038-2b95950d210b", "value": "fessleak@qip.ru" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "ip-dst", "uuid": "54eee189-5108-465b-8e6f-857e950d210b", "value": "216.157.99.23" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "ip-dst", "uuid": "54eee189-63b4-4396-8220-857e950d210b", "value": "216.157.99.25" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "ip-dst", "uuid": "54eee189-4f08-459b-8922-857e950d210b", "value": "216.151.221.212" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee189-cf34-45ae-bb2e-857e950d210b", "value": "chebroom.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee189-3bdc-4b02-902e-857e950d210b", "value": "kenthopm.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee189-1280-42d6-bde0-857e950d210b", "value": "vectallies.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee18a-ac30-4ee9-954d-857e950d210b", "value": "hevpazana.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee18a-71e0-4383-927f-857e950d210b", "value": "labutinra.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee18a-99b0-4983-83ef-857e950d210b", "value": "timarols.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee18a-355c-435b-9d1b-857e950d210b", "value": "pinkavuz.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee18a-b200-4ad7-9787-857e950d210b", "value": "beatrinko.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee18a-f1cc-45bd-b03d-857e950d210b", "value": "vemisaio.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee18a-0d34-4901-b46f-857e950d210b", "value": "zhonte.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee18a-6a08-45d5-84f4-857e950d210b", "value": "binachio.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee18a-52f4-4c6c-985a-857e950d210b", "value": "zarafint.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee18a-8060-4392-899e-857e950d210b", "value": "landors.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee18a-c6e8-4463-98a2-857e950d210b", "value": "tesuin.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee18a-b890-4fbe-bc3a-857e950d210b", "value": "rliner.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee18b-4330-4173-b7cf-857e950d210b", "value": "litpou.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee18b-7af0-4361-ac3a-857e950d210b", "value": "fersob.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee18b-1e7c-4847-8346-857e950d210b", "value": "estuty.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee18b-85d4-463d-8422-857e950d210b", "value": "ontiq.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee18b-c35c-47c3-bca2-857e950d210b", "value": "deinq.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee18b-4534-41cc-8940-857e950d210b", "value": "ermuz.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee18b-4bc4-4f91-85ce-857e950d210b", "value": "azurf.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee18b-f258-45e2-886a-857e950d210b", "value": "relom.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee18b-cb3c-4402-9fce-857e950d210b", "value": "retilio.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee18b-70e4-436c-97d6-857e950d210b", "value": "uvreno.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "ip-dst", "uuid": "54eee18b-0e50-46a3-8e95-857e950d210b", "value": "64.34.127.86" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "ip-dst", "uuid": "54eee18b-691c-43b0-8320-857e950d210b", "value": "64.34.127.134" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941939", "to_ids": true, "type": "domain", "uuid": "54eee18c-d5e0-4085-903f-857e950d210b", "value": "tunim.net" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941571", "to_ids": false, "type": "link", "uuid": "54eee203-a790-44a6-904c-5a29950d210b", "value": "https://labs.opendns.com/2015/02/19/fessleak-cool/" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941571", "to_ids": false, "type": "link", "uuid": "54eee203-d334-4171-a8e2-5a29950d210b", "value": "http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-new-adobe-flash-zero-day-exploit-used-in-malvertisements/" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941571", "to_ids": false, "type": "link", "uuid": "54eee203-36b0-42a7-a5cd-5a29950d210b", "value": "http://malware.dontneedcoffee.com/2015/01/unpatched-vulnerability-0day-in-flash.html" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941688", "to_ids": true, "type": "domain", "uuid": "54eee278-9c30-4481-b5f4-857e950d210b", "value": "ankapootle.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941688", "to_ids": true, "type": "domain", "uuid": "54eee278-c6d8-4838-b0af-857e950d210b", "value": "anster.net" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941689", "to_ids": true, "type": "domain", "uuid": "54eee279-66a4-4b4b-8cf0-857e950d210b", "value": "binjer.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941689", "to_ids": true, "type": "domain", "uuid": "54eee279-f4a0-4c96-9cda-857e950d210b", "value": "bizono.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941689", "to_ids": true, "type": "domain", "uuid": "54eee279-fd80-4a93-b328-857e950d210b", "value": "bracino.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941689", "to_ids": true, "type": "domain", "uuid": "54eee279-1014-42b8-830b-857e950d210b", "value": "dovimos.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941689", "to_ids": true, "type": "domain", "uuid": "54eee279-2098-4ffe-9753-857e950d210b", "value": "elimi.net" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941689", "to_ids": true, "type": "domain", "uuid": "54eee279-9c1c-4919-b8c3-857e950d210b", "value": "eltisc.net" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941689", "to_ids": true, "type": "domain", "uuid": "54eee279-5eb4-4139-92b2-857e950d210b", "value": "fenoli.net" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941689", "to_ids": true, "type": "domain", "uuid": "54eee279-c808-4619-ac54-857e950d210b", "value": "ferko.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941689", "to_ids": true, "type": "domain", "uuid": "54eee279-50c8-4b4c-8105-857e950d210b", "value": "fermentzone.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941689", "to_ids": true, "type": "domain", "uuid": "54eee279-0d7c-40ce-9644-857e950d210b", "value": "ferom.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941690", "to_ids": true, "type": "domain", "uuid": "54eee27a-6eb8-4720-a189-857e950d210b", "value": "flaris.net" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941690", "to_ids": true, "type": "domain", "uuid": "54eee27a-a1c8-4f20-b84b-857e950d210b", "value": "gladolimo.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941690", "to_ids": true, "type": "domain", "uuid": "54eee27a-38e8-4b9c-aa6a-857e950d210b", "value": "grandemab.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941690", "to_ids": true, "type": "domain", "uuid": "54eee27a-d3d8-4c96-b637-857e950d210b", "value": "ingoarten.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941690", "to_ids": true, "type": "domain", "uuid": "54eee27a-5468-4e35-80bf-857e950d210b", "value": "inpoucher.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941690", "to_ids": true, "type": "domain", "uuid": "54eee27a-860c-4dc4-a5bc-857e950d210b", "value": "kabur.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941690", "to_ids": true, "type": "domain", "uuid": "54eee27a-0598-4855-a9c3-857e950d210b", "value": "lemdingo.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941690", "to_ids": true, "type": "domain", "uuid": "54eee27a-d790-46bf-ae2d-857e950d210b", "value": "lemptyzp.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941690", "to_ids": true, "type": "domain", "uuid": "54eee27a-6fec-4d10-8747-857e950d210b", "value": "marzie.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941690", "to_ids": true, "type": "domain", "uuid": "54eee27a-de1c-4189-b727-857e950d210b", "value": "montiza.net" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941691", "to_ids": true, "type": "domain", "uuid": "54eee27b-cee0-410d-8e76-857e950d210b", "value": "namille.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941691", "to_ids": true, "type": "domain", "uuid": "54eee27b-5078-43fb-b46a-857e950d210b", "value": "orsai.net" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941691", "to_ids": true, "type": "domain", "uuid": "54eee27b-3c04-4caa-81a3-857e950d210b", "value": "pazumala.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941691", "to_ids": true, "type": "domain", "uuid": "54eee27b-d81c-4b00-94d0-857e950d210b", "value": "penazhef.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941691", "to_ids": true, "type": "domain", "uuid": "54eee27b-9838-4cb9-b567-857e950d210b", "value": "penneza.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941691", "to_ids": true, "type": "domain", "uuid": "54eee27b-7184-4e45-9d6a-857e950d210b", "value": "pequrio.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941691", "to_ids": true, "type": "domain", "uuid": "54eee27b-f2ec-4cc0-ba29-857e950d210b", "value": "pizzanetp.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941691", "to_ids": true, "type": "domain", "uuid": "54eee27b-e540-4987-8f15-857e950d210b", "value": "podin.net" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941691", "to_ids": true, "type": "domain", "uuid": "54eee27b-1360-44c2-8970-857e950d210b", "value": "pondoq.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941691", "to_ids": true, "type": "domain", "uuid": "54eee27b-2730-427e-92a5-857e950d210b", "value": "prosoknf.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941692", "to_ids": true, "type": "domain", "uuid": "54eee27c-2d6c-4dc2-bd8f-857e950d210b", "value": "ramonza.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941692", "to_ids": true, "type": "domain", "uuid": "54eee27c-11c4-4233-bbfd-857e950d210b", "value": "rampoyak.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941692", "to_ids": true, "type": "domain", "uuid": "54eee27c-a634-4f56-920c-857e950d210b", "value": "romaldi.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941692", "to_ids": true, "type": "domain", "uuid": "54eee27c-2418-4625-af7f-857e950d210b", "value": "shivue.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941692", "to_ids": true, "type": "domain", "uuid": "54eee27c-d2f0-47e4-9739-857e950d210b", "value": "venitial.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941692", "to_ids": true, "type": "domain", "uuid": "54eee27c-6d60-4ae9-b01c-857e950d210b", "value": "viceon.net" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941692", "to_ids": true, "type": "domain", "uuid": "54eee27c-ab84-4c66-b693-857e950d210b", "value": "webpertzo.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941692", "to_ids": true, "type": "domain", "uuid": "54eee27c-e824-4372-ae1b-857e950d210b", "value": "wonkobu.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941692", "to_ids": true, "type": "domain", "uuid": "54eee27c-106c-4d1f-bc04-857e950d210b", "value": "zelti.net" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941693", "to_ids": true, "type": "domain", "uuid": "54eee27d-fe48-4074-ab8b-857e950d210b", "value": "zibond.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1424941693", "to_ids": true, "type": "domain", "uuid": "54eee27d-62ec-4d79-add6-857e950d210b", "value": "ztopp.org" } ] } }