{
  "Event": {
    "analysis": "2",
    "date": "2015-05-13",
    "extends_uuid": "",
    "info": "OSINT Cylance SPEAR Team: A Threat Actor Resurfaces from Cylance",
    "publish_timestamp": "1432807341",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1432800092",
    "uuid": "555de343-19c0-42e9-b793-ab11950d210b",
    "Orgc": {
      "name": "CthulhuSPRL.be",
      "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
    },
    "Tag": [
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432216400",
        "to_ids": false,
        "type": "link",
        "uuid": "555de350-80d8-4e46-baa7-f22a950d210b",
        "value": "http://blog.cylance.com/spear-a-threat-actor-resurfaces"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432799161",
        "to_ids": true,
        "type": "sha256",
        "uuid": "5566c7b9-5c2c-4dcc-93b6-460e950d210b",
        "value": "6ba1d42c6493b18548e30bd60ca3d07a140d9d1945cf4e2b542e4a6d23913f40"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432799162",
        "to_ids": true,
        "type": "sha256",
        "uuid": "5566c7ba-c9e4-412e-bbee-4fa5950d210b",
        "value": "9d838fd9d21778ed9dc02226302b486d70ed13d4b3d914a3b512ea07bf67e165"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432799175",
        "to_ids": true,
        "type": "filename",
        "uuid": "5566c7c7-36b0-4d4d-a057-4b43950d210b",
        "value": "ISIS_twitter_list.doc"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432799200",
        "to_ids": true,
        "type": "filename",
        "uuid": "5566c7e0-2dd0-4bc1-b327-4224950d210b",
        "value": "%APPDATA%\\Microsoft\\Systemcertificates\\Certificates.ocx"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432799232",
        "to_ids": true,
        "type": "regkey|value",
        "uuid": "5566c800-ab24-4cc1-b8b0-44d9950d210b",
        "value": "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Certificates|Rundll32.exe \"%APPDATA%\\Microsoft\\SystemCertificates\\Certificates.ocx\",Setup"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432799298",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566c842-7bd8-4b53-8ff1-4741950d210b",
        "value": "www.microsoftservices.proxydns.com"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432799770",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566c842-1e54-4664-81b4-42f4950d210b",
        "value": "fighthard.mooo.com"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432799299",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566c843-bd4c-4aac-8863-4f24950d210b",
        "value": "rampage.freetcp.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432799315",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5566c853-a9bc-48a8-9f4c-418c950d210b",
        "value": "103.229.125.157"
      },
      {
        "category": "Attribution",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432799338",
        "to_ids": false,
        "type": "text",
        "uuid": "5566c86a-0b0c-4233-b704-48c8950d210b",
        "value": "C:\\Codes\\Eoehttp\\Release\\Eoehttp.pdb"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432799377",
        "to_ids": true,
        "type": "pattern-in-traffic",
        "uuid": "5566c891-7614-47a7-99f2-4d9d950d210b",
        "value": "<!--?*$"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432799399",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5566c8a7-5bf4-4bb0-9e26-4e22950d210b",
        "value": "173.224.214.12"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432799425",
        "to_ids": true,
        "type": "sha256",
        "uuid": "5566c8c1-d8c4-42d4-ae12-4ac8950d210b",
        "value": "8794189aad922f2287a56c5e2405b9fd8affd136286aad7ed893b90cd2b76b9c"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432799426",
        "to_ids": true,
        "type": "sha256",
        "uuid": "5566c8c2-1584-4cfa-80d5-4945950d210b",
        "value": "c593a844a87b3e40346efd5d314c55c5094d5bf191f9bb1aeec8078f6d07c0cd"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432799426",
        "to_ids": true,
        "type": "sha256",
        "uuid": "5566c8c2-6bfc-47c8-a1b3-4b55950d210b",
        "value": "3219767408bba3fa41b9ab5f964531cf608fb0288684748d6ac0b50cf108c911"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432799469",
        "to_ids": true,
        "type": "filename",
        "uuid": "5566c8ed-36a8-4f53-a490-4ce9950d210b",
        "value": "%TEMP%\\dw20.EXE"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432799470",
        "to_ids": true,
        "type": "filename",
        "uuid": "5566c8ee-dad4-417b-a752-443c950d210b",
        "value": "%WINDIR%\\msascm32.drv"
      },
      {
        "category": "Attribution",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432799500",
        "to_ids": false,
        "type": "text",
        "uuid": "5566c90c-abf4-4a58-8d7f-48e2950d210b",
        "value": "%USERPROFILE%\\Desktop\\msacm32\\Release\\msacm32.pdb"
      },
      {
        "category": "Attribution",
        "comment": "Poison Ivy shellcode encryption key",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432799720",
        "to_ids": false,
        "type": "text",
        "uuid": "5566c9e8-0a40-4a39-8331-4dc4950d210b",
        "value": "Tiger324{"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432799801",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566ca39-c570-45e4-a246-40b6950d210b",
        "value": "queenberry.www1.biz"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432799801",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566ca39-da1c-4ae8-ab54-45af950d210b",
        "value": "word.crabdance.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432799826",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5566ca52-a154-40eb-aa21-4747950d210b",
        "value": "64.71.162.70"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432799826",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5566ca52-1014-4d90-8f1e-4cda950d210b",
        "value": "108.171.246.140"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432799850",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566ca64-5b08-45eb-8f3a-41e6950d210b",
        "value": "www.ollay011.zyns.com"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432799865",
        "to_ids": false,
        "type": "link",
        "uuid": "5566ca79-0400-4335-b7c0-44f1950d210b",
        "value": "http://blog.shadowserver.org/2012/04/16/beware-of-what-you-download-recent-purported-ceiec-document-dump-booby-trapped/"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800088",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566cb58-ee24-452b-a1a4-4f98950d210b",
        "value": "microsoftservices.proxydns.com"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800088",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5566cb58-8248-418d-bf12-4ae6950d210b",
        "value": "103.238.227.69"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800088",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566cb58-a974-4835-a86a-4a03950d210b",
        "value": "www.micro.zyns.com"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800088",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566cb58-40b0-4f2a-aa33-48f2950d210b",
        "value": "computer001.dumb1.com"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800088",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566cb58-0890-4475-8476-49f5950d210b",
        "value": "microlab.dns04.com"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800088",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566cb58-b9f4-459d-9d1b-496e950d210b",
        "value": "fighhard.mooo.com"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800088",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5566cb58-c8b4-48b6-b49a-407b950d210b",
        "value": "162.251.122.216"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800089",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5566cb59-9428-4bc1-86e4-4015950d210b",
        "value": "121.127.249.97"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800089",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566cb59-f57c-4e44-bb0e-4e43950d210b",
        "value": "anhtuan88.ns01.biz"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800089",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566cb59-0e30-476a-9248-425c950d210b",
        "value": "anhphuong85.www1.biz"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800089",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566cb59-9a2c-49c5-a177-42a4950d210b",
        "value": "www.fornobody.dns04.com"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800089",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566cb59-36b8-4f29-a58d-4a78950d210b",
        "value": "ftp.fornobody.dns04.com"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800089",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566cb59-8664-4841-9bf2-49dc950d210b",
        "value": "fornobody.dns04.com"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800089",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5566cb59-5794-4a0e-9abb-4bc2950d210b",
        "value": "199.192.153.72"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800089",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566cb59-39d0-4dfb-b713-4669950d210b",
        "value": "www.qwertyui.dns04.com"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800090",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5566cb5a-8fe0-4a85-a7ca-4989950d210b",
        "value": "64.71.138.240"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800090",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566cb5a-04d8-4d21-83ac-497b950d210b",
        "value": "beyondbuck.dns1.us"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800090",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566cb5a-d600-4a98-a79b-46f1950d210b",
        "value": "letitsnowsmart.instanthq.com"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800090",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566cb5a-9750-4505-b04c-47a2950d210b",
        "value": "prime98.jumpingcrab.com"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800090",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566cb5a-99e4-45da-9b91-40e0950d210b",
        "value": "fuck.ruouvangnhatrang.com"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800090",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5566cb5a-c464-4e63-a793-4910950d210b",
        "value": "59.188.250.161"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800090",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566cb5a-ec34-42d2-baf3-452d950d210b",
        "value": "www.micro1.zyns.com"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800090",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5566cb5a-8058-40b0-9fbf-485f950d210b",
        "value": "118.99.13.184"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800091",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5566cb5b-f950-49eb-8a67-4efd950d210b",
        "value": "180.210.204.157"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800091",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566cb5b-eaf4-4752-9281-48f2950d210b",
        "value": "www.olay033.dns04.com"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800091",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566cb5b-6930-4a50-b5b8-4881950d210b",
        "value": "www.olay044.dns04.com"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800091",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566cb5b-7eb0-4417-96f1-4de4950d210b",
        "value": "9999992009.rr.nu"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800091",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566cb5b-9b28-4bee-8600-4469950d210b",
        "value": "9999992011.rr.nu"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800091",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566cb5b-7e7c-443d-b212-4ee1950d210b",
        "value": "9999992009.myfw.us"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800091",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5566cb5b-df6c-4960-8cf2-43f0950d210b",
        "value": "64.62.202.82"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800091",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566cb5c-91ac-4bb3-8880-498e950d210b",
        "value": "microlab.mrslove.com"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800092",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5566cb5c-28f8-49e5-8eb4-4ec8950d210b",
        "value": "203.80.238.183"
      },
      {
        "category": "Network activity",
        "comment": "Imported via the freetext import.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1432800092",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5566cb5c-5fdc-440b-b72d-4440950d210b",
        "value": "webhosts.sytes.net"
      }
    ]
  }
}