adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/5720669e-55ac-42ef-bc40-4b78950d210f.json

418 lines
No EOL
15 KiB
JSON
Raw Permalink Blame History

{
"Event": {
"analysis": "2",
"date": "2016-04-27",
"extends_uuid": "",
"info": "OSINT - New Poison Ivy Activity Targeting Myanmar, Asian Countries",
"publish_timestamp": "1461741972",
"published": true,
"threat_level_id": "3",
"timestamp": "1461741921",
"uuid": "5720669e-55ac-42ef-bc40-4b78950d210f",
"Orgc": {
"name": "CIRCL",
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
},
"Tag": [
{
"colour": "#ffffff",
"local": false,
"name": "tlp:white",
"relationship_type": ""
},
{
"colour": "#004646",
"local": false,
"name": "type:OSINT",
"relationship_type": ""
}
],
"Attribute": [
{
"category": "Network activity",
"comment": "Unique C2 Hostnames",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741358",
"to_ids": true,
"type": "hostname",
"uuid": "5720672e-e3ec-4191-bec0-475a950d210f",
"value": "news.tibetgroupworks.com"
},
{
"category": "Network activity",
"comment": "Unique C2 Hostnames",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741358",
"to_ids": true,
"type": "hostname",
"uuid": "5720672e-28d4-4158-b7ff-4cde950d210f",
"value": "web.microsoftdefence.com"
},
{
"category": "Network activity",
"comment": "Unique C2 Hostnames",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741358",
"to_ids": true,
"type": "hostname",
"uuid": "5720672e-d8ac-43c2-b401-47c9950d210f",
"value": "admin.nslookupdns.com"
},
{
"category": "Network activity",
"comment": "Unique C2 Hostnames",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741359",
"to_ids": true,
"type": "hostname",
"uuid": "5720672f-5cc0-45f3-8335-45ba950d210f",
"value": "jackhex.md5c.net"
},
{
"category": "Network activity",
"comment": "Unique C2 Hostnames",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741359",
"to_ids": true,
"type": "hostname",
"uuid": "5720672f-64ac-42fa-8431-4f09950d210f",
"value": "webserver.servehttp.com"
},
{
"category": "Payload delivery",
"comment": "Malware sample",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741625",
"to_ids": true,
"type": "sha1",
"uuid": "57206839-7adc-45ad-b90c-4393950d210f",
"value": "63e00dbf45961ad11bd1eb55dff9c2771c2916a6"
},
{
"category": "Payload delivery",
"comment": "Malware sample",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741625",
"to_ids": true,
"type": "sha1",
"uuid": "57206839-2274-4fa4-91a2-4aee950d210f",
"value": "675a3247f4c0e1105a41c685f4c2fb606e5b1eac"
},
{
"category": "Payload delivery",
"comment": "Malware sample",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741626",
"to_ids": true,
"type": "sha1",
"uuid": "5720683a-a1dc-4777-9b22-40e3950d210f",
"value": "49e36de6d757ca44c43d5670d497bd8738c1d2a4"
},
{
"category": "Payload delivery",
"comment": "Malware sample",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741626",
"to_ids": true,
"type": "sha1",
"uuid": "5720683a-de00-499a-9963-4a6b950d210f",
"value": "cbbfc3b5ff08de14fdb2316f3b14886dfe5504ef"
},
{
"category": "Payload delivery",
"comment": "Malware sample",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741626",
"to_ids": true,
"type": "sha1",
"uuid": "5720683a-70c4-4d63-a8f0-460f950d210f",
"value": "a7d206791b1cdec616e9b18ae6fa1548ca96a321"
},
{
"category": "Payload delivery",
"comment": "Malware sample",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741627",
"to_ids": true,
"type": "sha1",
"uuid": "5720683b-c4a4-4f2f-91d6-42d5950d210f",
"value": "ec646c57f9ac5e56230a17aeca6523a4532ff472"
},
{
"category": "Payload delivery",
"comment": "Malware sample",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741627",
"to_ids": true,
"type": "sha1",
"uuid": "5720683b-f100-4756-a65f-489c950d210f",
"value": "ef2618d58bd50fa232a19f9bcf3983d1e2dff266"
},
{
"category": "Payload delivery",
"comment": "Malware sample",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741628",
"to_ids": true,
"type": "sha1",
"uuid": "5720683c-6890-438f-b766-4576950d210f",
"value": "f389e1c970b2ca28112a30a8cfef1f3973fa82ea"
},
{
"category": "Payload delivery",
"comment": "Malware sample - Xchecked via VT: ef2618d58bd50fa232a19f9bcf3983d1e2dff266",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741689",
"to_ids": true,
"type": "sha256",
"uuid": "57206879-b23c-4749-95c9-433902de0b81",
"value": "02362ac6b456d3538b4a7ddd48690cabfaa466d346c72401a1286d28ddc6b04c"
},
{
"category": "Payload delivery",
"comment": "Malware sample - Xchecked via VT: ef2618d58bd50fa232a19f9bcf3983d1e2dff266",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741690",
"to_ids": true,
"type": "md5",
"uuid": "5720687a-4cfc-4c96-913d-4feb02de0b81",
"value": "277f3ada5fc43284b84b3b0e0e10a413"
},
{
"category": "External analysis",
"comment": "Malware sample - Xchecked via VT: ef2618d58bd50fa232a19f9bcf3983d1e2dff266",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741690",
"to_ids": false,
"type": "link",
"uuid": "5720687a-9bd0-46be-bf8f-42b402de0b81",
"value": "https://www.virustotal.com/file/02362ac6b456d3538b4a7ddd48690cabfaa466d346c72401a1286d28ddc6b04c/analysis/1457540291/"
},
{
"category": "Payload delivery",
"comment": "Malware sample - Xchecked via VT: ec646c57f9ac5e56230a17aeca6523a4532ff472",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741691",
"to_ids": true,
"type": "sha256",
"uuid": "5720687b-2e58-467a-b6c5-4a1a02de0b81",
"value": "3a9ab623c8a0a9f6c65e108e83c90da7620d2d6b22192c857556117587d0d038"
},
{
"category": "Payload delivery",
"comment": "Malware sample - Xchecked via VT: ec646c57f9ac5e56230a17aeca6523a4532ff472",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741691",
"to_ids": true,
"type": "md5",
"uuid": "5720687b-b328-4db6-8d52-473a02de0b81",
"value": "11eccf2c247dd4f9df730354b3e0947d"
},
{
"category": "External analysis",
"comment": "Malware sample - Xchecked via VT: ec646c57f9ac5e56230a17aeca6523a4532ff472",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741691",
"to_ids": false,
"type": "link",
"uuid": "5720687b-3670-4619-9690-4b7502de0b81",
"value": "https://www.virustotal.com/file/3a9ab623c8a0a9f6c65e108e83c90da7620d2d6b22192c857556117587d0d038/analysis/1459493835/"
},
{
"category": "Payload delivery",
"comment": "Malware sample - Xchecked via VT: a7d206791b1cdec616e9b18ae6fa1548ca96a321",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741692",
"to_ids": true,
"type": "sha256",
"uuid": "5720687c-a6d0-4a40-81da-462102de0b81",
"value": "81c07c15dd725f02f48859b6d493cd4b08f0a0939a57a7b2a869a8d71a3a1950"
},
{
"category": "Payload delivery",
"comment": "Malware sample - Xchecked via VT: a7d206791b1cdec616e9b18ae6fa1548ca96a321",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741692",
"to_ids": true,
"type": "md5",
"uuid": "5720687c-d4b0-4045-9f80-473602de0b81",
"value": "d2a4c1f91b2535cfe20c486fcdad907b"
},
{
"category": "External analysis",
"comment": "Malware sample - Xchecked via VT: a7d206791b1cdec616e9b18ae6fa1548ca96a321",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741693",
"to_ids": false,
"type": "link",
"uuid": "5720687d-c874-4e64-b207-48ba02de0b81",
"value": "https://www.virustotal.com/file/81c07c15dd725f02f48859b6d493cd4b08f0a0939a57a7b2a869a8d71a3a1950/analysis/1451297533/"
},
{
"category": "Payload delivery",
"comment": "Malware sample - Xchecked via VT: cbbfc3b5ff08de14fdb2316f3b14886dfe5504ef",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741693",
"to_ids": true,
"type": "sha256",
"uuid": "5720687d-9bd4-45c1-ae92-4a7402de0b81",
"value": "f7e667bc5d7d7e961f6afd880f979f4dfe52585e3379c5746a384d2a23b9fdf5"
},
{
"category": "Payload delivery",
"comment": "Malware sample - Xchecked via VT: cbbfc3b5ff08de14fdb2316f3b14886dfe5504ef",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741693",
"to_ids": true,
"type": "md5",
"uuid": "5720687d-a41c-47f7-999b-48b002de0b81",
"value": "241e30dd81588222c7f1ff92a53cc312"
},
{
"category": "External analysis",
"comment": "Malware sample - Xchecked via VT: cbbfc3b5ff08de14fdb2316f3b14886dfe5504ef",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741694",
"to_ids": false,
"type": "link",
"uuid": "5720687e-b544-490f-9475-47b402de0b81",
"value": "https://www.virustotal.com/file/f7e667bc5d7d7e961f6afd880f979f4dfe52585e3379c5746a384d2a23b9fdf5/analysis/1460040916/"
},
{
"category": "Payload delivery",
"comment": "Malware sample - Xchecked via VT: 49e36de6d757ca44c43d5670d497bd8738c1d2a4",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741694",
"to_ids": true,
"type": "sha256",
"uuid": "5720687e-58ac-4dda-b11d-4d5f02de0b81",
"value": "8a013fad26ea7c6a710c1646716c8e09d044598d25683470775b0da6048542a8"
},
{
"category": "Payload delivery",
"comment": "Malware sample - Xchecked via VT: 49e36de6d757ca44c43d5670d497bd8738c1d2a4",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741694",
"to_ids": true,
"type": "md5",
"uuid": "5720687e-69f0-4e06-bfb6-497602de0b81",
"value": "96bff6ef607bbe07c49357d0c58714a5"
},
{
"category": "External analysis",
"comment": "Malware sample - Xchecked via VT: 49e36de6d757ca44c43d5670d497bd8738c1d2a4",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741695",
"to_ids": false,
"type": "link",
"uuid": "5720687f-da04-4f1c-b759-499b02de0b81",
"value": "https://www.virustotal.com/file/8a013fad26ea7c6a710c1646716c8e09d044598d25683470775b0da6048542a8/analysis/1459494481/"
},
{
"category": "Payload delivery",
"comment": "Malware sample - Xchecked via VT: 675a3247f4c0e1105a41c685f4c2fb606e5b1eac",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741695",
"to_ids": true,
"type": "sha256",
"uuid": "5720687f-8180-47c8-8cda-46fb02de0b81",
"value": "1e2543e364217d9f48bf963709299fa54c381c6d583a419171d12e30d6e078e9"
},
{
"category": "Payload delivery",
"comment": "Malware sample - Xchecked via VT: 675a3247f4c0e1105a41c685f4c2fb606e5b1eac",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741695",
"to_ids": true,
"type": "md5",
"uuid": "5720687f-16bc-45d0-be6a-467f02de0b81",
"value": "be06e2f28143abdbaf61819e1746dfbe"
},
{
"category": "External analysis",
"comment": "Malware sample - Xchecked via VT: 675a3247f4c0e1105a41c685f4c2fb606e5b1eac",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741696",
"to_ids": false,
"type": "link",
"uuid": "57206880-44e4-47a5-97c7-4b4802de0b81",
"value": "https://www.virustotal.com/file/1e2543e364217d9f48bf963709299fa54c381c6d583a419171d12e30d6e078e9/analysis/1460373004/"
},
{
"category": "Payload delivery",
"comment": "Malware sample - Xchecked via VT: 63e00dbf45961ad11bd1eb55dff9c2771c2916a6",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741696",
"to_ids": true,
"type": "sha256",
"uuid": "57206880-7a7c-425b-9987-4f9302de0b81",
"value": "ac8fc264c7ec3cf70836e1bb21f9a20174b04ad49731b8797d7d8bb95cb353e2"
},
{
"category": "Payload delivery",
"comment": "Malware sample - Xchecked via VT: 63e00dbf45961ad11bd1eb55dff9c2771c2916a6",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741697",
"to_ids": true,
"type": "md5",
"uuid": "57206881-a5c4-44cd-a3a5-49e302de0b81",
"value": "9dd6fb40a7ace992bedc283dee79f50b"
},
{
"category": "External analysis",
"comment": "Malware sample - Xchecked via VT: 63e00dbf45961ad11bd1eb55dff9c2771c2916a6",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741697",
"to_ids": false,
"type": "link",
"uuid": "57206881-88f4-44b5-942d-4dc102de0b81",
"value": "https://www.virustotal.com/file/ac8fc264c7ec3cf70836e1bb21f9a20174b04ad49731b8797d7d8bb95cb353e2/analysis/1461585828/"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1461741921",
"to_ids": false,
"type": "comment",
"uuid": "57206961-530c-481e-a074-4466950d210f",
"value": "The infamous Remote Access Trojan (RAT) Poison Ivy (hereafter referred to as PIVY) has resurfaced recently, and exhibits some new behaviors. PIVY has been observed targeting a number of Asian countries for various purposes over the past year. Palo Alto Networks\u00e2\u20ac\u2122 Unit 42 recently blogged about a new Poison Ivy variant targeting Hong Kong activists dubbed SPIVY that uses DLL sideloading and operates quite differently from a variant recently observed by ASERT that has been active for at least the past 12 months."
}
]
}
}
Reference in a new issue View git blame Copy permalink