{
  "Event": {
    "analysis": "2",
    "date": "2014-10-03",
    "extends_uuid": "",
    "info": "OSINT New Indicators of Compromise for APT Group Nitro Uncovered blog post by Palo Alto Networks",
    "publish_timestamp": "1456150978",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1412579577",
    "uuid": "54323f2c-e50c-4268-896c-4867950d210b",
    "Orgc": {
      "name": "CthulhuSPRL.be",
      "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
    },
    "Tag": [
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#33FF00",
        "local": false,
        "name": "tlp:green",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1412579124",
        "to_ids": false,
        "type": "link",
        "uuid": "54323f34-fc28-4ad9-9295-4c32950d210b",
        "value": "http://researchcenter.paloaltonetworks.com/2014/10/new-indicators-compromise-apt-group-nitro-uncovered/"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1412579134",
        "to_ids": false,
        "type": "comment",
        "uuid": "54323f3e-df38-4d05-b6b8-4b14950d210b",
        "value": "Data encoded by David Andr\u00c3\u00a9"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1412579228",
        "to_ids": true,
        "type": "md5",
        "uuid": "54323f9c-2aec-42b7-8abb-41b1950d210b",
        "value": "7915aabb2e66ff14841e4ef0fbff7486"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1412579228",
        "to_ids": true,
        "type": "md5",
        "uuid": "54323f9c-2c00-4d9d-afd8-4ab8950d210b",
        "value": "7522baef20df95eeeeafdf4efe3aac3c"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1412579228",
        "to_ids": true,
        "type": "md5",
        "uuid": "54323f9c-e698-49c5-99e6-4039950d210b",
        "value": "6527ba8baab0f86b0ffb6178247772c4"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1412579228",
        "to_ids": true,
        "type": "md5",
        "uuid": "54323f9c-4138-4efc-a2ca-4851950d210b",
        "value": "271e6a4d45c2817f86148ca413f97604"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1412579228",
        "to_ids": true,
        "type": "md5",
        "uuid": "54323f9c-12b8-4909-86b1-45a8950d210b",
        "value": "be765cd5723e4366d35172aaf13fad44"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1412579228",
        "to_ids": true,
        "type": "md5",
        "uuid": "54323f9c-2768-4c9f-b004-4fc5950d210b",
        "value": "ec519d709c0582346741fe0094208216"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1412579228",
        "to_ids": true,
        "type": "md5",
        "uuid": "54323f9c-dc1c-442d-843f-490f950d210b",
        "value": "a3b2e34973691ad320b70248bd67fbd2"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1412579394",
        "to_ids": true,
        "type": "sha256",
        "uuid": "54324042-49fc-4628-a95e-44da950d210b",
        "value": "0a1103bc90725d4665b932f88e81d39eafa5823b0de3ab146e2d4548b7da79a0"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1412579394",
        "to_ids": true,
        "type": "sha256",
        "uuid": "54324042-7c14-4318-a5c0-4600950d210b",
        "value": "8aef92a986568ba31729269efa31a2488f35920d136ab41cb6fce55fd8e0b4b7"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1412579394",
        "to_ids": true,
        "type": "sha256",
        "uuid": "54324042-4f8c-4ce1-b8f6-4be8950d210b",
        "value": "995bc16a5c2c212b57ba00c2376ac57c8032c7f2b1d521f995a5e1d49066d64d"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1412579394",
        "to_ids": true,
        "type": "sha256",
        "uuid": "54324042-f50c-47f1-9140-435b950d210b",
        "value": "e7f2af8c48f837da57000c068368d77bc9b06eba1e077edfab58df6aa2ea40ec"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1412579394",
        "to_ids": true,
        "type": "sha256",
        "uuid": "54324042-512c-46e0-9551-49cb950d210b",
        "value": "e601da16f923b33465dbafbff9d47195e8fc50099fd0581a16a1745bf890afb6"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1412579394",
        "to_ids": true,
        "type": "sha256",
        "uuid": "54324042-863c-4553-b05c-4174950d210b",
        "value": "184c083e839451c2ab0de7a89aa801dc0458e2bd1fe79e60f35c26d92a0dbf6a"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1412579394",
        "to_ids": true,
        "type": "sha256",
        "uuid": "54324042-a9f0-473c-9284-4f56950d210b",
        "value": "ffbddfb536e8e604c880ec977d06f804a500fc0396899bd2c195fb1f5b74207a"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1412579457",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54324081-3308-4f1f-8674-4953950d210b",
        "value": "223.25.233.248"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1412579457",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54324081-08ec-4161-a2ed-4c75950d210b",
        "value": "196.45.144.12"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1412579548",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543240dc-f068-437a-baa9-48f2950d210b",
        "value": "xenserver.ddns.net"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1412579548",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543240dc-7fac-4be4-93e8-482b950d210b",
        "value": "zipoo.redirectme.net"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1412579548",
        "to_ids": true,
        "type": "hostname",
        "uuid": "543240dc-ca14-4537-a5df-4aba950d210b",
        "value": "good.myftp.org"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1412579577",
        "to_ids": false,
        "type": "text",
        "uuid": "543240f9-64e8-41f2-958f-4e21950d210b",
        "value": "Nitro"
      },
      {
        "category": "External analysis",
        "comment": "Automatically added (via 7915aabb2e66ff14841e4ef0fbff7486)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455826343",
        "to_ids": true,
        "type": "sha1",
        "uuid": "56c625a7-f31c-460c-9ea1-c652950d210f",
        "value": "0ea76f1586c008932d90c991dfdd5042f3aac8ea"
      },
      {
        "category": "External analysis",
        "comment": "Automatically added (via 7522baef20df95eeeeafdf4efe3aac3c)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455826345",
        "to_ids": true,
        "type": "sha1",
        "uuid": "56c625a9-0850-4f0e-ba6b-59a4950d210f",
        "value": "7c5b1cd43daa19289d629fd969ea0b16c04803fb"
      },
      {
        "category": "External analysis",
        "comment": "Automatically added (via 6527ba8baab0f86b0ffb6178247772c4)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455826346",
        "to_ids": true,
        "type": "sha1",
        "uuid": "56c625aa-b0e4-4e44-b997-4d98950d210f",
        "value": "d76a8a3c3e6f14ba31e1a42fa63455260f2a9b1a"
      },
      {
        "category": "External analysis",
        "comment": "Automatically added (via 271e6a4d45c2817f86148ca413f97604)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455826347",
        "to_ids": true,
        "type": "sha1",
        "uuid": "56c625ab-2708-47fb-bc05-c650950d210f",
        "value": "8554ac096023dec3235a4c627cc9fd4c5ab0cac8"
      },
      {
        "category": "External analysis",
        "comment": "Automatically added (via be765cd5723e4366d35172aaf13fad44)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455826348",
        "to_ids": true,
        "type": "sha1",
        "uuid": "56c625ac-14e4-409a-91bb-c651950d210f",
        "value": "0a0a610b209dbed9029dbdf2843f7682b6a5c6ad"
      },
      {
        "category": "External analysis",
        "comment": "Automatically added (via ec519d709c0582346741fe0094208216)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455826349",
        "to_ids": true,
        "type": "sha1",
        "uuid": "56c625ad-4fa8-4a43-9c0e-59a1950d210f",
        "value": "074df94be307c60e1c1b35c5872654dabb3d61f7"
      },
      {
        "category": "External analysis",
        "comment": "Automatically added (via a3b2e34973691ad320b70248bd67fbd2)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455826350",
        "to_ids": true,
        "type": "sha1",
        "uuid": "56c625ae-9b04-4e28-8806-4e26950d210f",
        "value": "5591bae552004f38964f6a0bec7bf9ce5f2b37cc"
      }
    ]
  }
}