682 lines
No EOL
21 KiB
JSON
682 lines
No EOL
21 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2015-05-13",
|
|
"extends_uuid": "",
|
|
"info": "OSINT Cylance SPEAR Team: A Threat Actor Resurfaces from Cylance",
|
|
"publish_timestamp": "1432807341",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1432800092",
|
|
"uuid": "555de343-19c0-42e9-b793-ab11950d210b",
|
|
"Orgc": {
|
|
"name": "CthulhuSPRL.be",
|
|
"uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#004646",
|
|
"local": false,
|
|
"name": "type:OSINT",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": false,
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432216400",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "555de350-80d8-4e46-baa7-f22a950d210b",
|
|
"value": "http://blog.cylance.com/spear-a-threat-actor-resurfaces"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432799161",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5566c7b9-5c2c-4dcc-93b6-460e950d210b",
|
|
"value": "6ba1d42c6493b18548e30bd60ca3d07a140d9d1945cf4e2b542e4a6d23913f40"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432799162",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5566c7ba-c9e4-412e-bbee-4fa5950d210b",
|
|
"value": "9d838fd9d21778ed9dc02226302b486d70ed13d4b3d914a3b512ea07bf67e165"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432799175",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "5566c7c7-36b0-4d4d-a057-4b43950d210b",
|
|
"value": "ISIS_twitter_list.doc"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432799200",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "5566c7e0-2dd0-4bc1-b327-4224950d210b",
|
|
"value": "%APPDATA%\\Microsoft\\Systemcertificates\\Certificates.ocx"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432799232",
|
|
"to_ids": true,
|
|
"type": "regkey|value",
|
|
"uuid": "5566c800-ab24-4cc1-b8b0-44d9950d210b",
|
|
"value": "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Certificates|Rundll32.exe \"%APPDATA%\\Microsoft\\SystemCertificates\\Certificates.ocx\",Setup"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432799298",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566c842-7bd8-4b53-8ff1-4741950d210b",
|
|
"value": "www.microsoftservices.proxydns.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432799770",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566c842-1e54-4664-81b4-42f4950d210b",
|
|
"value": "fighthard.mooo.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432799299",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566c843-bd4c-4aac-8863-4f24950d210b",
|
|
"value": "rampage.freetcp.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432799315",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5566c853-a9bc-48a8-9f4c-418c950d210b",
|
|
"value": "103.229.125.157"
|
|
},
|
|
{
|
|
"category": "Attribution",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432799338",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5566c86a-0b0c-4233-b704-48c8950d210b",
|
|
"value": "C:\\Codes\\Eoehttp\\Release\\Eoehttp.pdb"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432799377",
|
|
"to_ids": true,
|
|
"type": "pattern-in-traffic",
|
|
"uuid": "5566c891-7614-47a7-99f2-4d9d950d210b",
|
|
"value": "<!--?*$"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432799399",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5566c8a7-5bf4-4bb0-9e26-4e22950d210b",
|
|
"value": "173.224.214.12"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432799425",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5566c8c1-d8c4-42d4-ae12-4ac8950d210b",
|
|
"value": "8794189aad922f2287a56c5e2405b9fd8affd136286aad7ed893b90cd2b76b9c"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432799426",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5566c8c2-1584-4cfa-80d5-4945950d210b",
|
|
"value": "c593a844a87b3e40346efd5d314c55c5094d5bf191f9bb1aeec8078f6d07c0cd"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432799426",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5566c8c2-6bfc-47c8-a1b3-4b55950d210b",
|
|
"value": "3219767408bba3fa41b9ab5f964531cf608fb0288684748d6ac0b50cf108c911"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432799469",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "5566c8ed-36a8-4f53-a490-4ce9950d210b",
|
|
"value": "%TEMP%\\dw20.EXE"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432799470",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "5566c8ee-dad4-417b-a752-443c950d210b",
|
|
"value": "%WINDIR%\\msascm32.drv"
|
|
},
|
|
{
|
|
"category": "Attribution",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432799500",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5566c90c-abf4-4a58-8d7f-48e2950d210b",
|
|
"value": "%USERPROFILE%\\Desktop\\msacm32\\Release\\msacm32.pdb"
|
|
},
|
|
{
|
|
"category": "Attribution",
|
|
"comment": "Poison Ivy shellcode encryption key",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432799720",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5566c9e8-0a40-4a39-8331-4dc4950d210b",
|
|
"value": "Tiger324{"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432799801",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566ca39-c570-45e4-a246-40b6950d210b",
|
|
"value": "queenberry.www1.biz"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432799801",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566ca39-da1c-4ae8-ab54-45af950d210b",
|
|
"value": "word.crabdance.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432799826",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5566ca52-a154-40eb-aa21-4747950d210b",
|
|
"value": "64.71.162.70"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432799826",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5566ca52-1014-4d90-8f1e-4cda950d210b",
|
|
"value": "108.171.246.140"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432799850",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566ca64-5b08-45eb-8f3a-41e6950d210b",
|
|
"value": "www.ollay011.zyns.com"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432799865",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5566ca79-0400-4335-b7c0-44f1950d210b",
|
|
"value": "http://blog.shadowserver.org/2012/04/16/beware-of-what-you-download-recent-purported-ceiec-document-dump-booby-trapped/"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800088",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566cb58-ee24-452b-a1a4-4f98950d210b",
|
|
"value": "microsoftservices.proxydns.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800088",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5566cb58-8248-418d-bf12-4ae6950d210b",
|
|
"value": "103.238.227.69"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800088",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566cb58-a974-4835-a86a-4a03950d210b",
|
|
"value": "www.micro.zyns.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800088",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566cb58-40b0-4f2a-aa33-48f2950d210b",
|
|
"value": "computer001.dumb1.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800088",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566cb58-0890-4475-8476-49f5950d210b",
|
|
"value": "microlab.dns04.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800088",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566cb58-b9f4-459d-9d1b-496e950d210b",
|
|
"value": "fighhard.mooo.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800088",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5566cb58-c8b4-48b6-b49a-407b950d210b",
|
|
"value": "162.251.122.216"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800089",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5566cb59-9428-4bc1-86e4-4015950d210b",
|
|
"value": "121.127.249.97"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800089",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566cb59-f57c-4e44-bb0e-4e43950d210b",
|
|
"value": "anhtuan88.ns01.biz"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800089",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566cb59-0e30-476a-9248-425c950d210b",
|
|
"value": "anhphuong85.www1.biz"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800089",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566cb59-9a2c-49c5-a177-42a4950d210b",
|
|
"value": "www.fornobody.dns04.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800089",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566cb59-36b8-4f29-a58d-4a78950d210b",
|
|
"value": "ftp.fornobody.dns04.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800089",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566cb59-8664-4841-9bf2-49dc950d210b",
|
|
"value": "fornobody.dns04.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800089",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5566cb59-5794-4a0e-9abb-4bc2950d210b",
|
|
"value": "199.192.153.72"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800089",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566cb59-39d0-4dfb-b713-4669950d210b",
|
|
"value": "www.qwertyui.dns04.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800090",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5566cb5a-8fe0-4a85-a7ca-4989950d210b",
|
|
"value": "64.71.138.240"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800090",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566cb5a-04d8-4d21-83ac-497b950d210b",
|
|
"value": "beyondbuck.dns1.us"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800090",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566cb5a-d600-4a98-a79b-46f1950d210b",
|
|
"value": "letitsnowsmart.instanthq.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800090",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566cb5a-9750-4505-b04c-47a2950d210b",
|
|
"value": "prime98.jumpingcrab.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800090",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566cb5a-99e4-45da-9b91-40e0950d210b",
|
|
"value": "fuck.ruouvangnhatrang.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800090",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5566cb5a-c464-4e63-a793-4910950d210b",
|
|
"value": "59.188.250.161"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800090",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566cb5a-ec34-42d2-baf3-452d950d210b",
|
|
"value": "www.micro1.zyns.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800090",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5566cb5a-8058-40b0-9fbf-485f950d210b",
|
|
"value": "118.99.13.184"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800091",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5566cb5b-f950-49eb-8a67-4efd950d210b",
|
|
"value": "180.210.204.157"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800091",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566cb5b-eaf4-4752-9281-48f2950d210b",
|
|
"value": "www.olay033.dns04.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800091",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566cb5b-6930-4a50-b5b8-4881950d210b",
|
|
"value": "www.olay044.dns04.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800091",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566cb5b-7eb0-4417-96f1-4de4950d210b",
|
|
"value": "9999992009.rr.nu"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800091",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566cb5b-9b28-4bee-8600-4469950d210b",
|
|
"value": "9999992011.rr.nu"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800091",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566cb5b-7e7c-443d-b212-4ee1950d210b",
|
|
"value": "9999992009.myfw.us"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800091",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5566cb5b-df6c-4960-8cf2-43f0950d210b",
|
|
"value": "64.62.202.82"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800091",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566cb5c-91ac-4bb3-8880-498e950d210b",
|
|
"value": "microlab.mrslove.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800092",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5566cb5c-28f8-49e5-8eb4-4ec8950d210b",
|
|
"value": "203.80.238.183"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1432800092",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5566cb5c-5fdc-440b-b72d-4440950d210b",
|
|
"value": "webhosts.sytes.net"
|
|
}
|
|
]
|
|
}
|
|
} |