{
  "Event": {
    "analysis": "1",
    "date": "2019-08-23",
    "extends_uuid": "",
    "info": "OSINT - Emotet is back",
    "publish_timestamp": "1566554421",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1566554356",
    "uuid": "5d5fb3ac-ae54-42d3-9fe7-4d65950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#004646",
        "name": "type:OSINT"
      },
      {
        "colour": "#0071c3",
        "name": "osint:lifetime=\"perpetual\""
      },
      {
        "colour": "#0087e8",
        "name": "osint:certainty=\"50\""
      },
      {
        "colour": "#ffffff",
        "name": "tlp:white"
      },
      {
        "colour": "#0088cc",
        "name": "misp-galaxy:banker=\"Geodo\""
      },
      {
        "colour": "#6edb00",
        "name": "circl:topic=\"finance\""
      },
      {
        "colour": "#410069",
        "name": "adversary:infrastructure-action=\"take-down\""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "On port 8080",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553026",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5d5fb3c2-d6e0-4095-9993-4c97950d210f",
        "value": "104.131.11.150|8080"
      },
      {
        "category": "Network activity",
        "comment": "On port 8080",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553026",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5d5fb3c2-5990-4b73-8048-4ea4950d210f",
        "value": "104.131.208.175|8080"
      },
      {
        "category": "Network activity",
        "comment": "On port 7080",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553026",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5d5fb3c2-31c0-4be9-ba1e-4e88950d210f",
        "value": "104.236.151.95|7080"
      },
      {
        "category": "Network activity",
        "comment": "On port 443",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553026",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5d5fb3c2-7310-4300-a2c4-4b28950d210f",
        "value": "142.93.88.16|443"
      },
      {
        "category": "Network activity",
        "comment": "On port 80",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553026",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5d5fb3c2-c9e0-44a3-9555-4697950d210f",
        "value": "144.139.247.220|80"
      },
      {
        "category": "Network activity",
        "comment": "On port 7080",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553026",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5d5fb3c2-d334-4057-95b6-492a950d210f",
        "value": "159.89.179.87|7080"
      },
      {
        "category": "Network activity",
        "comment": "On port 8080",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553026",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5d5fb3c2-561c-42d1-bd6a-45a9950d210f",
        "value": "162.144.119.216|8080"
      },
      {
        "category": "Network activity",
        "comment": "On port 8080",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553027",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5d5fb3c3-5cd0-4800-94ee-4ba9950d210f",
        "value": "162.243.125.212|8080"
      },
      {
        "category": "Network activity",
        "comment": "On port 8080",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553027",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5d5fb3c3-5f68-465e-8cd0-4a51950d210f",
        "value": "170.150.11.245|8080"
      },
      {
        "category": "Network activity",
        "comment": "On port 8080",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553027",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5d5fb3c3-a218-4ed7-8fdc-4335950d210f",
        "value": "176.31.200.130|8080"
      },
      {
        "category": "Network activity",
        "comment": "On port 80",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553027",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5d5fb3c3-e0c4-4972-84b4-4d0b950d210f",
        "value": "177.242.214.30|80"
      },
      {
        "category": "Network activity",
        "comment": "On port 22",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553027",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5d5fb3c3-fc90-407f-a872-432d950d210f",
        "value": "187.163.180.243|22"
      },
      {
        "category": "Network activity",
        "comment": "On port 8080",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553027",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5d5fb3c3-b0f8-4c12-8a49-4f67950d210f",
        "value": "195.242.117.231|8080"
      },
      {
        "category": "Network activity",
        "comment": "On port 8080",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553027",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5d5fb3c3-af24-45fc-a5cb-4f46950d210f",
        "value": "216.98.148.156|8080"
      },
      {
        "category": "Network activity",
        "comment": "On port 7080",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553027",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5d5fb3c3-b57c-4cbb-9fd2-4656950d210f",
        "value": "217.13.106.160|7080"
      },
      {
        "category": "Network activity",
        "comment": "On port 7080",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553028",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5d5fb3c4-40e0-43cf-81d5-4c7f950d210f",
        "value": "31.12.67.62|7080"
      },
      {
        "category": "Network activity",
        "comment": "On port 443",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553028",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5d5fb3c4-7894-4619-adff-4671950d210f",
        "value": "45.123.3.54|443"
      },
      {
        "category": "Network activity",
        "comment": "On port 7080",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553028",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5d5fb3c4-3e94-4a12-b058-4323950d210f",
        "value": "45.32.158.232|7080"
      },
      {
        "category": "Network activity",
        "comment": "On port 8080",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553028",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5d5fb3c4-bb1c-4558-8b00-4c11950d210f",
        "value": "46.101.142.115|8080"
      },
      {
        "category": "Network activity",
        "comment": "On port 443",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553028",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5d5fb3c4-6584-4403-a760-4cd1950d210f",
        "value": "46.105.131.69|443"
      },
      {
        "category": "Network activity",
        "comment": "On port 8080",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553028",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5d5fb3c4-79e8-4334-9903-423f950d210f",
        "value": "64.13.225.150|8080"
      },
      {
        "category": "Network activity",
        "comment": "On port 8080",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553028",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5d5fb3c4-138c-4d34-a862-4c82950d210f",
        "value": "69.45.19.145|8080"
      },
      {
        "category": "Network activity",
        "comment": "On port 8080",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553028",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5d5fb3c4-d820-4140-a769-4718950d210f",
        "value": "70.32.84.74|8080"
      },
      {
        "category": "Network activity",
        "comment": "On port 8080",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553028",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5d5fb3c4-7778-4691-9d87-4f86950d210f",
        "value": "75.127.14.170|8080"
      },
      {
        "category": "Network activity",
        "comment": "On port 7080",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553028",
        "to_ids": true,
        "type": "ip-dst|port",
        "uuid": "5d5fb3c4-0420-4c80-a6c3-42eb950d210f",
        "value": "91.83.93.103|7080"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553051",
        "to_ids": false,
        "type": "link",
        "uuid": "5d5fb3db-706c-4b79-a949-492d950d210f",
        "value": "https://pastebin.com/raw/7Kq2e1ik"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1566553091",
        "to_ids": false,
        "type": "link",
        "uuid": "5d5fb403-4d9c-4908-b127-4bec950d210f",
        "value": "https://github.com/blacklotuslabs/Research/blob/master/Emotet_Active_C2_08_22_19.txt"
      }
    ]
  }
}