{
  "Event": {
    "analysis": "2",
    "date": "2016-02-13",
    "extends_uuid": "",
    "info": "Additional IPs for Turla/Uroburos from CIRCL Passive SSL",
    "publish_timestamp": "1498162463",
    "published": true,
    "threat_level_id": "1",
    "timestamp": "1498162425",
    "uuid": "56c18ccb-4c10-49ee-bf65-4b54950d210f",
    "Orgc": {
      "name": "CthulhuSPRL.be",
      "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
    },
    "Tag": [
      {
        "colour": "#33FF00",
        "local": false,
        "name": "tlp:green",
        "relationship_type": ""
      },
      {
        "colour": "#12e200",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"Turla Group\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525130",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d0a-3044-4a60-851e-4aad950d210f",
        "value": "209.239.79.29"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525130",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d0a-85b8-47d7-b18e-4571950d210f",
        "value": "83.229.103.133"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525130",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d0a-8ebc-4383-8e80-4ffb950d210f",
        "value": "169.255.100.222"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525131",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d0b-4234-4cdc-90d3-41f8950d210f",
        "value": "78.138.25.29"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525131",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d0b-25ec-4494-b7ce-4d59950d210f",
        "value": "82.146.174.240"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525131",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d0b-3198-4b66-9b4e-49cb950d210f",
        "value": "83.229.62.179"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525132",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d0c-2774-40fe-94bd-4668950d210f",
        "value": "193.220.55.6"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525132",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d0c-8cc8-4764-aa30-4e2c950d210f",
        "value": "83.229.62.212"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525132",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d0c-8620-44a9-acce-4b0a950d210f",
        "value": "169.255.100.152"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525133",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d0d-eec8-4f07-928c-41d5950d210f",
        "value": "113.208.81.33"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525133",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d0d-ed24-4783-bcaf-48b1950d210f",
        "value": "82.146.174.40"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525133",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d0d-8c50-4300-92b4-456c950d210f",
        "value": "31.209.133.125"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525134",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d0e-5834-491e-b8bf-4caf950d210f",
        "value": "82.146.175.52"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525134",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d0e-b86c-41cf-9917-47c2950d210f",
        "value": "113.208.81.48"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525134",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d0e-8bcc-42a5-a11a-4801950d210f",
        "value": "83.229.75.141"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525134",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d0e-d274-485d-b855-402b950d210f",
        "value": "77.246.76.19"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525135",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d0f-4ffc-4160-8c0c-435d950d210f",
        "value": "209.239.79.125"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525135",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d0f-2cf8-4a49-a84d-411a950d210f",
        "value": "217.194.150.31"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525135",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d0f-39dc-4ea2-b99f-4460950d210f",
        "value": "169.255.102.246"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525136",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d10-41f4-49eb-8644-44da950d210f",
        "value": "169.255.101.235"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525136",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d10-b688-477c-93be-47a8950d210f",
        "value": "82.146.166.58"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525136",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d10-9e50-4c2d-ace2-41d3950d210f",
        "value": "217.194.149.111"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525136",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d10-bed4-40bb-800b-4f50950d210f",
        "value": "169.255.102.110"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525137",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d11-2cbc-49fc-8277-432c950d210f",
        "value": "169.255.100.122"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525137",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d11-cea8-4af3-bddc-4557950d210f",
        "value": "169.255.101.65"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525137",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d11-d9a0-4c9e-ac83-40b7950d210f",
        "value": "82.146.175.48"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525138",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d12-9a4c-4346-87db-46db950d210f",
        "value": "113.208.81.55"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525138",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d12-25c8-4479-a395-488b950d210f",
        "value": "82.146.166.61"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525138",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d12-d7f4-44b9-8b1a-4cf9950d210f",
        "value": "217.8.36.239"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525138",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d12-6cd8-4eed-a84f-47cb950d210f",
        "value": "83.229.62.210"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525139",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d13-c59c-4e66-8720-4ddc950d210f",
        "value": "92.62.221.47"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525139",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d13-7228-4aa5-bf37-4a65950d210f",
        "value": "82.146.175.69"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525139",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d13-4594-426f-bbae-4244950d210f",
        "value": "82.146.175.29"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525139",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d13-f7ec-4b92-a29d-42ed950d210f",
        "value": "83.229.62.249"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525140",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d14-99fc-41d8-8bf9-48dc950d210f",
        "value": "41.203.79.74"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525140",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "56c18d14-91e8-4402-9d1a-4013950d210f",
        "value": "217.194.150.22"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525173",
        "to_ids": false,
        "type": "link",
        "uuid": "56c18d35-4654-4518-9bfa-468b950d210f",
        "value": "https://twitter.com/circl_lu/status/698524566763806720"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455525173",
        "to_ids": false,
        "type": "link",
        "uuid": "56c18d35-bad0-4968-baf4-4da0950d210f",
        "value": "http://pastebin.lu/oteminohod.cs"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455526580",
        "to_ids": true,
        "type": "x509-fingerprint-sha1",
        "uuid": "56c192b4-cbf0-4bf1-9ac8-48e7950d210f",
        "value": "f415844680ed9118ea74e0c7712b35044f0cc20d"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455526652",
        "to_ids": false,
        "type": "text",
        "uuid": "56c192fc-3ccc-48e7-b8c2-4b18950d210f",
        "value": "Turla"
      },
      {
        "category": "Attribution",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455526677",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "56c19315-7a94-421a-8066-4523950d210f",
        "value": "Turla"
      }
    ]
  }
}