506 lines
No EOL
16 KiB
JSON
506 lines
No EOL
16 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2014-11-03",
|
|
"extends_uuid": "",
|
|
"info": "OSINT 20141107B: Operation Poisoned Handover by ThreatConnect",
|
|
"publish_timestamp": "1418932639",
|
|
"published": true,
|
|
"threat_level_id": "4",
|
|
"timestamp": "1418930421",
|
|
"uuid": "54932814-7834-4667-8b08-4c2f950d210b",
|
|
"Orgc": {
|
|
"name": "CthulhuSPRL.be",
|
|
"uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#004646",
|
|
"local": false,
|
|
"name": "type:OSINT",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#33FF00",
|
|
"local": false,
|
|
"name": "tlp:green",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930227",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "54932833-d47c-4d3e-805b-2601950d210b",
|
|
"value": "Poisoned Handover"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930227",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "54932833-09d8-4d74-bd7f-2601950d210b",
|
|
"value": "Poisoned Hurricane"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930241",
|
|
"to_ids": false,
|
|
"type": "comment",
|
|
"uuid": "54932841-47ac-4ae7-a61c-41c3950d210b",
|
|
"value": "Data entered by David Andr\u00c3\u00a9"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930281",
|
|
"to_ids": false,
|
|
"type": "comment",
|
|
"uuid": "54932861-54ac-4d81-ad2d-40cf950d210b",
|
|
"value": "Incident related to 20140806B: Operation Poisoned Hurricane targeting Hong Kong Pro-Democracy websites with DDoS attacks found in FireEye blog \"Operation Poisoned Handover\"."
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930329",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "54932899-92dc-4687-86d8-4c28950d210b",
|
|
"value": "e2a4b96cce9de4fb126cfd5f5c73c3ed"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930329",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "54932899-c920-47d6-be13-4c26950d210b",
|
|
"value": "17bc9d2a640da75db6cbb66e5898feb1"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930329",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "54932899-04b8-4e92-939b-4831950d210b",
|
|
"value": "daf5dfe91f417b2ec50a19c07bc7d9f4ce467507f791c9dd71acaaf8a8360901"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930329",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "54932899-b0ac-4ea3-b7eb-4f37950d210b",
|
|
"value": "caa5529010c17b969da01ade084794c6"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930329",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "54932899-c588-41f8-8f04-4fa2950d210b",
|
|
"value": "51748b7bb7db3d599e00440211f07e2d94a05793"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930329",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "54932899-8864-4378-9983-4fa8950d210b",
|
|
"value": "136e709cc83cbda0cd8ca6e46fe9e57202bd2699ca063f9d1a51602394c06ef3"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930329",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "54932899-57f0-4954-8ff9-4406950d210b",
|
|
"value": "84bd0809b1dbc2dc86f30d30faaa7e4e"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930329",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "54932899-4728-4bb3-bcf5-48c9950d210b",
|
|
"value": "eba48a0b5fe89797150abf64c0d46f073f89b76c"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930329",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "54932899-2d50-41a1-9a0e-483c950d210b",
|
|
"value": "79752dc96e971b697be5c9425b9485352adf1424dbb55dba0f8565b144059b68"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930329",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "54932899-cd18-4c72-8c25-4295950d210b",
|
|
"value": "c3d6450075d618b1edba17ee723eb3ca"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930329",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "54932899-8324-4f50-834e-4de4950d210b",
|
|
"value": "d8079b683f025d1cd6529ebe1338a2578b809dc2"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930330",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5493289a-dbdc-4a7c-9d38-4b92950d210b",
|
|
"value": "ecf21054ab515946a812d1aa5c408ca5"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930330",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5493289a-a444-48f7-bd09-4589950d210b",
|
|
"value": "2bf948ba2a265346878a36740a32a55038d122bd"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930330",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5493289a-2308-4c86-b8a9-4c0d950d210b",
|
|
"value": "0b54ae49fd5a841970b98a078968cb6b"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930330",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5493289a-2dd0-4f90-a64f-409c950d210b",
|
|
"value": "4b21534104eaa1a8f5d2273afd4292c3b55b045fe2ff3b09284dbacd42076106"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930330",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5493289a-254c-4198-bd39-4da5950d210b",
|
|
"value": "0baa6b822c22856eb085590addb79431eb3ad83c"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930330",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5493289a-af78-4d51-b279-417c950d210b",
|
|
"value": "39bb90140fc0101f49377b6c60076f9d"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930330",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5493289a-8c78-4c41-b6f0-4d8e950d210b",
|
|
"value": "00cd8c4f87a82b442509402a4f9e6a7a14dc78f286ace619702adfdd09b72f9f"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930330",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5493289a-7024-4070-89c1-467b950d210b",
|
|
"value": "03d047380078676b17617ce04a6585ab71640790"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930330",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5493289a-6be4-4803-afda-4352950d210b",
|
|
"value": "d08e038d318b94764d199d7a85047637"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930330",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5493289a-0094-4b86-a2b4-45b5950d210b",
|
|
"value": "c74c612fb5aa6924e5d7b6014932c02ab58c81def48503fbead3f0c22b8eea9e"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930330",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5493289a-5b2c-43b6-945a-421b950d210b",
|
|
"value": "c346a1d50b237c0360278442422e32ff0158322c"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930330",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5493289a-65a8-46e1-8dad-4892950d210b",
|
|
"value": "7896327da3087d3fc54581e69537825ae2789fc1a87086098a5f735fccf6a52d"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930346",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "549328aa-7e68-43d9-8f37-484e950d210b",
|
|
"value": "https://app.threatconnect.com/tc/auth/incident/incident.xhtml?incident=167842"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930398",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "549328de-1634-44d1-8919-423a950d210b",
|
|
"value": "luxscena.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930398",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "549328de-7ca4-4499-a7dd-466b950d210b",
|
|
"value": "tommo.jp"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930399",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "549328df-8fa8-4e6f-8770-480d950d210b",
|
|
"value": "java-se.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930399",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "549328df-83e4-449e-9012-4d91950d210b",
|
|
"value": "wizapply.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930399",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "549328df-5fd4-4e50-ae2a-42b3950d210b",
|
|
"value": "ninekobe.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930399",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "549328df-5310-43bc-a706-474e950d210b",
|
|
"value": "shinzenho.jp"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930399",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "549328df-1258-437c-8787-4b33950d210b",
|
|
"value": "nitori-tour.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930399",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "549328df-d394-4ca0-b78e-4c54950d210b",
|
|
"value": "mizma.co.jp"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930399",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "549328df-2964-4d25-9bdb-4f2f950d210b",
|
|
"value": "wakayamasatei.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930421",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "549328f5-0838-4ae9-a30c-442a950d210b",
|
|
"value": "p.java-sec.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930421",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "549328f5-4968-4769-91ea-4597950d210b",
|
|
"value": "sp.you-maga.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930421",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "549328f5-cfdc-44a3-a6ae-486a950d210b",
|
|
"value": "www.credo-biz.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930421",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "549328f5-3090-4b20-90bd-4ce7950d210b",
|
|
"value": "jre76.java-se.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930421",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "549328f5-72c8-4545-b2be-4e03950d210b",
|
|
"value": "hk.java-se.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1418930421",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "549328f5-91f8-4b5f-a372-42b0950d210b",
|
|
"value": "u.java-se.com"
|
|
}
|
|
]
|
|
}
|
|
} |