{
  "Event": {
    "analysis": "2",
    "date": "2016-04-27",
    "extends_uuid": "",
    "info": "OSINT - New Poison Ivy Activity Targeting Myanmar, Asian Countries",
    "publish_timestamp": "1461741972",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1461741921",
    "uuid": "5720669e-55ac-42ef-bc40-4b78950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "name": "tlp:white"
      },
      {
        "colour": "#004646",
        "name": "type:OSINT"
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "Unique C2 Hostnames",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741358",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5720672e-e3ec-4191-bec0-475a950d210f",
        "value": "news.tibetgroupworks.com"
      },
      {
        "category": "Network activity",
        "comment": "Unique C2 Hostnames",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741358",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5720672e-28d4-4158-b7ff-4cde950d210f",
        "value": "web.microsoftdefence.com"
      },
      {
        "category": "Network activity",
        "comment": "Unique C2 Hostnames",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741358",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5720672e-d8ac-43c2-b401-47c9950d210f",
        "value": "admin.nslookupdns.com"
      },
      {
        "category": "Network activity",
        "comment": "Unique C2 Hostnames",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741359",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5720672f-5cc0-45f3-8335-45ba950d210f",
        "value": "jackhex.md5c.net"
      },
      {
        "category": "Network activity",
        "comment": "Unique C2 Hostnames",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741359",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5720672f-64ac-42fa-8431-4f09950d210f",
        "value": "webserver.servehttp.com"
      },
      {
        "category": "Payload delivery",
        "comment": "Malware sample",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741625",
        "to_ids": true,
        "type": "sha1",
        "uuid": "57206839-7adc-45ad-b90c-4393950d210f",
        "value": "63e00dbf45961ad11bd1eb55dff9c2771c2916a6"
      },
      {
        "category": "Payload delivery",
        "comment": "Malware sample",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741625",
        "to_ids": true,
        "type": "sha1",
        "uuid": "57206839-2274-4fa4-91a2-4aee950d210f",
        "value": "675a3247f4c0e1105a41c685f4c2fb606e5b1eac"
      },
      {
        "category": "Payload delivery",
        "comment": "Malware sample",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741626",
        "to_ids": true,
        "type": "sha1",
        "uuid": "5720683a-a1dc-4777-9b22-40e3950d210f",
        "value": "49e36de6d757ca44c43d5670d497bd8738c1d2a4"
      },
      {
        "category": "Payload delivery",
        "comment": "Malware sample",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741626",
        "to_ids": true,
        "type": "sha1",
        "uuid": "5720683a-de00-499a-9963-4a6b950d210f",
        "value": "cbbfc3b5ff08de14fdb2316f3b14886dfe5504ef"
      },
      {
        "category": "Payload delivery",
        "comment": "Malware sample",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741626",
        "to_ids": true,
        "type": "sha1",
        "uuid": "5720683a-70c4-4d63-a8f0-460f950d210f",
        "value": "a7d206791b1cdec616e9b18ae6fa1548ca96a321"
      },
      {
        "category": "Payload delivery",
        "comment": "Malware sample",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741627",
        "to_ids": true,
        "type": "sha1",
        "uuid": "5720683b-c4a4-4f2f-91d6-42d5950d210f",
        "value": "ec646c57f9ac5e56230a17aeca6523a4532ff472"
      },
      {
        "category": "Payload delivery",
        "comment": "Malware sample",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741627",
        "to_ids": true,
        "type": "sha1",
        "uuid": "5720683b-f100-4756-a65f-489c950d210f",
        "value": "ef2618d58bd50fa232a19f9bcf3983d1e2dff266"
      },
      {
        "category": "Payload delivery",
        "comment": "Malware sample",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741628",
        "to_ids": true,
        "type": "sha1",
        "uuid": "5720683c-6890-438f-b766-4576950d210f",
        "value": "f389e1c970b2ca28112a30a8cfef1f3973fa82ea"
      },
      {
        "category": "Payload delivery",
        "comment": "Malware sample - Xchecked via VT: ef2618d58bd50fa232a19f9bcf3983d1e2dff266",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741689",
        "to_ids": true,
        "type": "sha256",
        "uuid": "57206879-b23c-4749-95c9-433902de0b81",
        "value": "02362ac6b456d3538b4a7ddd48690cabfaa466d346c72401a1286d28ddc6b04c"
      },
      {
        "category": "Payload delivery",
        "comment": "Malware sample - Xchecked via VT: ef2618d58bd50fa232a19f9bcf3983d1e2dff266",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741690",
        "to_ids": true,
        "type": "md5",
        "uuid": "5720687a-4cfc-4c96-913d-4feb02de0b81",
        "value": "277f3ada5fc43284b84b3b0e0e10a413"
      },
      {
        "category": "External analysis",
        "comment": "Malware sample - Xchecked via VT: ef2618d58bd50fa232a19f9bcf3983d1e2dff266",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741690",
        "to_ids": false,
        "type": "link",
        "uuid": "5720687a-9bd0-46be-bf8f-42b402de0b81",
        "value": "https://www.virustotal.com/file/02362ac6b456d3538b4a7ddd48690cabfaa466d346c72401a1286d28ddc6b04c/analysis/1457540291/"
      },
      {
        "category": "Payload delivery",
        "comment": "Malware sample - Xchecked via VT: ec646c57f9ac5e56230a17aeca6523a4532ff472",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741691",
        "to_ids": true,
        "type": "sha256",
        "uuid": "5720687b-2e58-467a-b6c5-4a1a02de0b81",
        "value": "3a9ab623c8a0a9f6c65e108e83c90da7620d2d6b22192c857556117587d0d038"
      },
      {
        "category": "Payload delivery",
        "comment": "Malware sample - Xchecked via VT: ec646c57f9ac5e56230a17aeca6523a4532ff472",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741691",
        "to_ids": true,
        "type": "md5",
        "uuid": "5720687b-b328-4db6-8d52-473a02de0b81",
        "value": "11eccf2c247dd4f9df730354b3e0947d"
      },
      {
        "category": "External analysis",
        "comment": "Malware sample - Xchecked via VT: ec646c57f9ac5e56230a17aeca6523a4532ff472",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741691",
        "to_ids": false,
        "type": "link",
        "uuid": "5720687b-3670-4619-9690-4b7502de0b81",
        "value": "https://www.virustotal.com/file/3a9ab623c8a0a9f6c65e108e83c90da7620d2d6b22192c857556117587d0d038/analysis/1459493835/"
      },
      {
        "category": "Payload delivery",
        "comment": "Malware sample - Xchecked via VT: a7d206791b1cdec616e9b18ae6fa1548ca96a321",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741692",
        "to_ids": true,
        "type": "sha256",
        "uuid": "5720687c-a6d0-4a40-81da-462102de0b81",
        "value": "81c07c15dd725f02f48859b6d493cd4b08f0a0939a57a7b2a869a8d71a3a1950"
      },
      {
        "category": "Payload delivery",
        "comment": "Malware sample - Xchecked via VT: a7d206791b1cdec616e9b18ae6fa1548ca96a321",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741692",
        "to_ids": true,
        "type": "md5",
        "uuid": "5720687c-d4b0-4045-9f80-473602de0b81",
        "value": "d2a4c1f91b2535cfe20c486fcdad907b"
      },
      {
        "category": "External analysis",
        "comment": "Malware sample - Xchecked via VT: a7d206791b1cdec616e9b18ae6fa1548ca96a321",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741693",
        "to_ids": false,
        "type": "link",
        "uuid": "5720687d-c874-4e64-b207-48ba02de0b81",
        "value": "https://www.virustotal.com/file/81c07c15dd725f02f48859b6d493cd4b08f0a0939a57a7b2a869a8d71a3a1950/analysis/1451297533/"
      },
      {
        "category": "Payload delivery",
        "comment": "Malware sample - Xchecked via VT: cbbfc3b5ff08de14fdb2316f3b14886dfe5504ef",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741693",
        "to_ids": true,
        "type": "sha256",
        "uuid": "5720687d-9bd4-45c1-ae92-4a7402de0b81",
        "value": "f7e667bc5d7d7e961f6afd880f979f4dfe52585e3379c5746a384d2a23b9fdf5"
      },
      {
        "category": "Payload delivery",
        "comment": "Malware sample - Xchecked via VT: cbbfc3b5ff08de14fdb2316f3b14886dfe5504ef",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741693",
        "to_ids": true,
        "type": "md5",
        "uuid": "5720687d-a41c-47f7-999b-48b002de0b81",
        "value": "241e30dd81588222c7f1ff92a53cc312"
      },
      {
        "category": "External analysis",
        "comment": "Malware sample - Xchecked via VT: cbbfc3b5ff08de14fdb2316f3b14886dfe5504ef",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741694",
        "to_ids": false,
        "type": "link",
        "uuid": "5720687e-b544-490f-9475-47b402de0b81",
        "value": "https://www.virustotal.com/file/f7e667bc5d7d7e961f6afd880f979f4dfe52585e3379c5746a384d2a23b9fdf5/analysis/1460040916/"
      },
      {
        "category": "Payload delivery",
        "comment": "Malware sample - Xchecked via VT: 49e36de6d757ca44c43d5670d497bd8738c1d2a4",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741694",
        "to_ids": true,
        "type": "sha256",
        "uuid": "5720687e-58ac-4dda-b11d-4d5f02de0b81",
        "value": "8a013fad26ea7c6a710c1646716c8e09d044598d25683470775b0da6048542a8"
      },
      {
        "category": "Payload delivery",
        "comment": "Malware sample - Xchecked via VT: 49e36de6d757ca44c43d5670d497bd8738c1d2a4",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741694",
        "to_ids": true,
        "type": "md5",
        "uuid": "5720687e-69f0-4e06-bfb6-497602de0b81",
        "value": "96bff6ef607bbe07c49357d0c58714a5"
      },
      {
        "category": "External analysis",
        "comment": "Malware sample - Xchecked via VT: 49e36de6d757ca44c43d5670d497bd8738c1d2a4",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741695",
        "to_ids": false,
        "type": "link",
        "uuid": "5720687f-da04-4f1c-b759-499b02de0b81",
        "value": "https://www.virustotal.com/file/8a013fad26ea7c6a710c1646716c8e09d044598d25683470775b0da6048542a8/analysis/1459494481/"
      },
      {
        "category": "Payload delivery",
        "comment": "Malware sample - Xchecked via VT: 675a3247f4c0e1105a41c685f4c2fb606e5b1eac",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741695",
        "to_ids": true,
        "type": "sha256",
        "uuid": "5720687f-8180-47c8-8cda-46fb02de0b81",
        "value": "1e2543e364217d9f48bf963709299fa54c381c6d583a419171d12e30d6e078e9"
      },
      {
        "category": "Payload delivery",
        "comment": "Malware sample - Xchecked via VT: 675a3247f4c0e1105a41c685f4c2fb606e5b1eac",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741695",
        "to_ids": true,
        "type": "md5",
        "uuid": "5720687f-16bc-45d0-be6a-467f02de0b81",
        "value": "be06e2f28143abdbaf61819e1746dfbe"
      },
      {
        "category": "External analysis",
        "comment": "Malware sample - Xchecked via VT: 675a3247f4c0e1105a41c685f4c2fb606e5b1eac",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741696",
        "to_ids": false,
        "type": "link",
        "uuid": "57206880-44e4-47a5-97c7-4b4802de0b81",
        "value": "https://www.virustotal.com/file/1e2543e364217d9f48bf963709299fa54c381c6d583a419171d12e30d6e078e9/analysis/1460373004/"
      },
      {
        "category": "Payload delivery",
        "comment": "Malware sample - Xchecked via VT: 63e00dbf45961ad11bd1eb55dff9c2771c2916a6",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741696",
        "to_ids": true,
        "type": "sha256",
        "uuid": "57206880-7a7c-425b-9987-4f9302de0b81",
        "value": "ac8fc264c7ec3cf70836e1bb21f9a20174b04ad49731b8797d7d8bb95cb353e2"
      },
      {
        "category": "Payload delivery",
        "comment": "Malware sample - Xchecked via VT: 63e00dbf45961ad11bd1eb55dff9c2771c2916a6",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741697",
        "to_ids": true,
        "type": "md5",
        "uuid": "57206881-a5c4-44cd-a3a5-49e302de0b81",
        "value": "9dd6fb40a7ace992bedc283dee79f50b"
      },
      {
        "category": "External analysis",
        "comment": "Malware sample - Xchecked via VT: 63e00dbf45961ad11bd1eb55dff9c2771c2916a6",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741697",
        "to_ids": false,
        "type": "link",
        "uuid": "57206881-88f4-44b5-942d-4dc102de0b81",
        "value": "https://www.virustotal.com/file/ac8fc264c7ec3cf70836e1bb21f9a20174b04ad49731b8797d7d8bb95cb353e2/analysis/1461585828/"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461741921",
        "to_ids": false,
        "type": "comment",
        "uuid": "57206961-530c-481e-a074-4466950d210f",
        "value": "The infamous Remote Access Trojan (RAT) Poison Ivy (hereafter referred to as PIVY) has resurfaced recently, and exhibits some new behaviors. PIVY has been observed targeting a number of Asian countries for various purposes over the past year. Palo Alto Networks\u00e2\u20ac\u2122 Unit 42 recently blogged about a new Poison Ivy variant targeting Hong Kong activists dubbed SPIVY that uses DLL sideloading and operates quite differently from a variant recently observed by ASERT that has been active for at least the past 12 months."
      }
    ]
  }
}