adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/5474459d-1c60-456a-b057-4bdc950d210b.json

363 lines
No EOL
10 KiB
JSON
Raw Permalink Blame History

{
"Event": {
"analysis": "2",
"date": "2014-11-21",
"extends_uuid": "",
"info": "OSINT Operation Double Tap from FireEye",
"publish_timestamp": "1422291233",
"published": true,
"threat_level_id": "2",
"timestamp": "1422269529",
"uuid": "5474459d-1c60-456a-b057-4bdc950d210b",
"Orgc": {
"name": "CthulhuSPRL.be",
"uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
},
"Tag": [
{
"colour": "#004646",
"local": false,
"name": "type:OSINT",
"relationship_type": ""
},
{
"colour": "#33FF00",
"local": false,
"name": "tlp:green",
"relationship_type": ""
}
],
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906151",
"to_ids": false,
"type": "link",
"uuid": "547445a7-3164-46d3-9c23-4e61950d210b",
"value": "https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906179",
"to_ids": false,
"type": "text",
"uuid": "547445c3-5b5c-49a6-a928-45a5950d210b",
"value": "APT3"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906179",
"to_ids": false,
"type": "text",
"uuid": "547445c3-24b8-4f71-bd6c-4ccd950d210b",
"value": "UPS"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906179",
"to_ids": false,
"type": "text",
"uuid": "547445c3-eca0-4eda-82aa-493a950d210b",
"value": "Operation Clandestine Fox"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906179",
"to_ids": false,
"type": "text",
"uuid": "547445c3-7c64-41bb-882f-40b8950d210b",
"value": "Clandestine Fox"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906204",
"to_ids": false,
"type": "comment",
"uuid": "547445dc-8fa4-48fc-8ba8-9e39950d210b",
"value": "Data entered by David ANDRE"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906230",
"to_ids": false,
"type": "vulnerability",
"uuid": "547445f6-b298-4ea9-93fa-f86d950d210b",
"value": "CVE-2014-6332"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906230",
"to_ids": false,
"type": "vulnerability",
"uuid": "547445f6-e44c-4db8-8e83-f86d950d210b",
"value": "CVE-2014-4113"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906295",
"to_ids": true,
"type": "md5",
"uuid": "54744638-bbb8-480b-a710-476e950d210b",
"value": "5a0c4e1925c76a959ab0588f683ab437"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906296",
"to_ids": true,
"type": "md5",
"uuid": "54744638-9f64-4b40-b6b3-476e950d210b",
"value": "492a839a3bf9c61b7065589a18c5aa8d"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906296",
"to_ids": true,
"type": "md5",
"uuid": "54744638-5f98-4012-a6ed-476e950d210b",
"value": "744a17a3bc6dbd535f568ef1e87d8b9a"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906296",
"to_ids": true,
"type": "md5",
"uuid": "54744638-10bc-4f77-9945-476e950d210b",
"value": "5c08957f05377004376e6a622406f9aa"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906360",
"to_ids": true,
"type": "pattern-in-file",
"uuid": "54744678-280c-4a9c-ae2d-4d12950d210b",
"value": "%USERPROFILE%\\Documents\\Visual Studio 2008\\Projects\\MShell\\Release\\MShell.pdb"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906360",
"to_ids": true,
"type": "pattern-in-file",
"uuid": "54744678-2fd4-45f2-a1a1-49db950d210b",
"value": "%USERPROFILE%\\Documents\\Visual Studio 2008\\Projects\\4113\\Release\\4113.pdb"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906360",
"to_ids": true,
"type": "pattern-in-file",
"uuid": "54744678-8284-4572-b6ea-4112950d210b",
"value": "%USERPROFILE%\\Documents\\Visual Studio 2010\\Projects\\MyRat\\Client\\Client\\obj\\x86\\Release\\Client.pdb"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906409",
"to_ids": true,
"type": "ip-dst",
"uuid": "547446a9-8200-4d85-b473-4eae950d210b",
"value": "192.157.198.103"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906409",
"to_ids": true,
"type": "ip-dst",
"uuid": "547446a9-90e4-4653-ab99-4ddf950d210b",
"value": "210.109.99.64"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906409",
"to_ids": true,
"type": "ip-dst",
"uuid": "547446a9-409c-428c-ba14-4d62950d210b",
"value": "192.184.60.229"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906409",
"to_ids": true,
"type": "ip-dst",
"uuid": "547446a9-799c-4f23-a52f-4871950d210b",
"value": "198.55.115.71"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906434",
"to_ids": true,
"type": "hostname",
"uuid": "547446c2-a09c-4a4b-8f91-44a4950d210b",
"value": "inform.bedircati.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906434",
"to_ids": true,
"type": "hostname",
"uuid": "547446c2-bef4-4f07-88b0-48f5950d210b",
"value": "pn.lamb-site.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906471",
"to_ids": true,
"type": "hostname",
"uuid": "547446e7-7414-4a27-9505-4d81950d210b",
"value": "securitywap.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906471",
"to_ids": true,
"type": "hostname",
"uuid": "547446e7-d078-4cbf-9780-49fe950d210b",
"value": "www.securitywap.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906540",
"to_ids": true,
"type": "ip-dst",
"uuid": "5474472c-1498-40ec-94a9-402d950d210b",
"value": "104.151.248.173"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906577",
"to_ids": true,
"type": "hostname",
"uuid": "54744751-3e1c-47e7-b3ba-428b950d210b",
"value": "join.playboysplus.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906577",
"to_ids": true,
"type": "hostname",
"uuid": "54744751-596c-4935-81e9-4238950d210b",
"value": "walterclean.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906577",
"to_ids": true,
"type": "hostname",
"uuid": "54744751-2a40-4cad-89da-4e6c950d210b",
"value": "www.walterclean.com"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906618",
"to_ids": false,
"type": "link",
"uuid": "5474477a-bf40-4c76-8817-476e950d210b",
"value": "https://github.com/fireeye/iocs/tree/master/APT3"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906742",
"to_ids": false,
"type": "text",
"uuid": "547447f6-e394-440d-9044-4066950d210b",
"value": "Double Tap"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1416906742",
"to_ids": false,
"type": "text",
"uuid": "547447f6-39d0-4340-8a51-4986950d210b",
"value": "Operation Double Tap"
}
]
}
}
Reference in a new issue View git blame Copy permalink