1408 lines
No EOL
40 KiB
JSON
1408 lines
No EOL
40 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2015-12-03",
|
|
"extends_uuid": "",
|
|
"info": "OSINT IOC from ponmocup malware",
|
|
"publish_timestamp": "1450133971",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1450133882",
|
|
"uuid": "566f4900-9da4-4ee7-b237-8a63950d210b",
|
|
"Orgc": {
|
|
"name": "CthulhuSPRL.be",
|
|
"uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": false,
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#004646",
|
|
"local": false,
|
|
"name": "type:OSINT",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133781",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4915-adb4-4496-9bd5-a574950d210b",
|
|
"value": "abccornet.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133782",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4916-92f8-4aa6-928e-a574950d210b",
|
|
"value": "109.74.195.149"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133782",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4916-d0ac-4e74-a055-a574950d210b",
|
|
"value": "adertisecorp.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133783",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4917-a55c-47db-891c-a574950d210b",
|
|
"value": "243.182.100.227"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133783",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4917-1e18-42c3-8707-a574950d210b",
|
|
"value": "affilipcorp.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133783",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4917-a124-4e5f-bfba-a574950d210b",
|
|
"value": "4.227.70.65"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133784",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4918-b28c-4245-87f0-a574950d210b",
|
|
"value": "anexcorp.org"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133784",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4918-4ebc-4708-86e1-a574950d210b",
|
|
"value": "63.77.106.1"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133785",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4919-45d0-4e98-be23-a574950d210b",
|
|
"value": "britishfederal.org"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133785",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4919-6b90-4fa6-9a3f-a574950d210b",
|
|
"value": "166.178.113.144"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133785",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4919-4674-416e-bb99-a574950d210b",
|
|
"value": "changinessmen.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f491a-8a64-4613-b793-a574950d210b",
|
|
"value": "231.150.98.137"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133786",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f491a-f210-4e4d-b986-a574950d210b",
|
|
"value": "claimsreference.net"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133787",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f491b-216c-4a56-b1db-a574950d210b",
|
|
"value": "31.171.130.249"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f491b-9db0-4350-94ff-a574950d210b",
|
|
"value": "clickoptimiser.net"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133788",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f491c-15a0-481d-9df8-a574950d210b",
|
|
"value": "85.66.23.125"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f491c-a0a0-488c-8927-a574950d210b",
|
|
"value": "contentdeliveryorg.net"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133788",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f491c-18fc-48c9-ad68-a574950d210b",
|
|
"value": "6.88.25.80"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133789",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f491d-3150-4c52-8e49-a574950d210b",
|
|
"value": "contextexpert.org"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133789",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f491d-6924-4cf0-825c-a574950d210b",
|
|
"value": "80.213.59.50"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133790",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f491e-6d3c-4186-8568-a574950d210b",
|
|
"value": "continuatu.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133790",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f491e-da44-41f0-b282-a574950d210b",
|
|
"value": "222.219.85.79"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133790",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f491e-0540-42da-8b26-a574950d210b",
|
|
"value": "culminaccessful.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133791",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f491f-dce4-40d3-afb6-a574950d210b",
|
|
"value": "234.102.81.206"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133791",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f491f-5f9c-40a9-81bd-a574950d210b",
|
|
"value": "cybernan.net"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133792",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4920-52fc-4f13-81d6-a574950d210b",
|
|
"value": "116.181.5.61"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133792",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4920-8a88-4ea5-bc4a-a574950d210b",
|
|
"value": "defenciclovis.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133793",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4921-c744-4cb1-9238-a574950d210b",
|
|
"value": "156.44.195.200"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133793",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4921-da44-4879-86ec-a574950d210b",
|
|
"value": "descriptioned.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133793",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4921-a96c-43c7-b2d1-a574950d210b",
|
|
"value": "21.8.194.15"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133794",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4922-71fc-4ee4-b91d-a574950d210b",
|
|
"value": "detroportans.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133794",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4922-64f0-4581-8372-a574950d210b",
|
|
"value": "42.107.140.147"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133795",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4923-4b70-4e1a-9df5-a574950d210b",
|
|
"value": "directiculture.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133795",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4923-7400-49da-9611-a574950d210b",
|
|
"value": "199.172.52.66"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133795",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4923-12d0-41f4-9548-a574950d210b",
|
|
"value": "directlyvast.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133796",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4924-906c-4980-a6a9-a574950d210b",
|
|
"value": "227.248.14.79"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133796",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4924-5814-4e17-9521-a574950d210b",
|
|
"value": "dogmationation.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133797",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4925-6408-4ced-9f21-a574950d210b",
|
|
"value": "155.83.123.22"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133797",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4925-ebd0-4ce3-9daa-a574950d210b",
|
|
"value": "dynodns.org"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133798",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4926-5af8-442a-b61b-a574950d210b",
|
|
"value": "44.36.245.224"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133798",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4926-f170-4f1c-a1d0-a574950d210b",
|
|
"value": "enckfeld.net"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133798",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4926-37dc-4ff7-873c-a574950d210b",
|
|
"value": "168.23.171.69"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133799",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4927-bff0-42ad-9dce-a574950d210b",
|
|
"value": "familyinteresting.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133799",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4927-50a0-4968-ac7b-a574950d210b",
|
|
"value": "204.37.98.202"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133800",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4928-88e8-456a-9577-a574950d210b",
|
|
"value": "fasternation.net"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133800",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4928-57c4-42fa-b346-a574950d210b",
|
|
"value": "253.101.238.123"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133800",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4928-ce80-4589-9dd5-a574950d210b",
|
|
"value": "freewayreg.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133801",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4929-a55c-4a09-a738-a574950d210b",
|
|
"value": "94.75.201.33"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133801",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4929-9624-4065-b010-a574950d210b",
|
|
"value": "headedpicked.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133802",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f492a-6ef4-49f7-853b-a574950d210b",
|
|
"value": "40.22.124.164"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133802",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f492a-30f4-4d47-b599-a574950d210b",
|
|
"value": "headedpicked.net"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133803",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f492b-7f34-46e2-aebc-a574950d210b",
|
|
"value": "49.197.32.49"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133803",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f492b-6868-4990-ba9f-a574950d210b",
|
|
"value": "highlytraditional.org"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133803",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f492b-5fe8-4926-8e02-a574950d210b",
|
|
"value": "104.127.201.198"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133804",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f492c-2814-4e9d-ad63-a574950d210b",
|
|
"value": "himmeding.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133804",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f492c-ded8-4b5a-9304-a574950d210b",
|
|
"value": "144.61.46.13"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133805",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f492d-819c-4959-b0d5-a574950d210b",
|
|
"value": "howeveraged.net"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133805",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f492d-4ff0-4b17-a699-a574950d210b",
|
|
"value": "203.136.214.219"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133805",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f492d-0068-4aab-9c3e-a574950d210b",
|
|
"value": "hydroelection.net"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133806",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f492e-dd18-4e79-8eab-a574950d210b",
|
|
"value": "253.134.178.81"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133806",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f492e-b3f8-4f60-8e8a-a574950d210b",
|
|
"value": "illegedly.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133807",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f492f-f9e8-4542-86f9-a574950d210b",
|
|
"value": "106.8.16.175"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133807",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f492f-6e54-43ad-81e4-a574950d210b",
|
|
"value": "imagesharehost.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133807",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f492f-5308-409f-985a-a574950d210b",
|
|
"value": "204.11.56.48"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133808",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4930-d58c-4945-ad45-a574950d210b",
|
|
"value": "leadwriting.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133808",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4930-372c-4629-a1ab-a574950d210b",
|
|
"value": "41.252.243.242"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133809",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4931-7154-47a1-9f5e-a574950d210b",
|
|
"value": "meetinglimited.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133809",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4931-094c-4916-a929-a574950d210b",
|
|
"value": "151.225.26.181"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133810",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4932-bd68-4ad6-a267-a574950d210b",
|
|
"value": "netdiscovery.org"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133810",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4932-46a4-4967-a92a-a574950d210b",
|
|
"value": "106.110.29.248"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133810",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4932-239c-43be-a948-a574950d210b",
|
|
"value": "picasootoolbar.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133811",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4933-1df4-4fc7-b844-a574950d210b",
|
|
"value": "114.225.99.185"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133811",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4933-1794-477f-a1c9-a574950d210b",
|
|
"value": "piclbumestream.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133812",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4934-d908-45fd-86c4-a574950d210b",
|
|
"value": "2.171.234.238"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133812",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4934-0cec-4196-9c93-a574950d210b",
|
|
"value": "postdone.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133812",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4934-f468-42f1-84d9-a574950d210b",
|
|
"value": "50.116.56.144"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133813",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4935-1d94-4bcc-a29a-a574950d210b",
|
|
"value": "ratilovskoye.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133813",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4935-2838-445d-be81-a574950d210b",
|
|
"value": "102.209.206.89"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133814",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4936-fcfc-4318-8992-a574950d210b",
|
|
"value": "recising.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133814",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4936-c9e0-48e2-a6f3-a574950d210b",
|
|
"value": "7.34.116.64"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133815",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4937-9a84-4b03-ab11-a574950d210b",
|
|
"value": "searchforthat.net"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133815",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4937-17b4-4f57-bb1c-a574950d210b",
|
|
"value": "38.155.216.69"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133815",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4937-a8c0-4cf4-8f6a-a574950d210b",
|
|
"value": "sectionsfear.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133816",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4938-d854-4c56-b599-a574950d210b",
|
|
"value": "27.251.60.63"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133816",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4938-1134-473e-bf82-a574950d210b",
|
|
"value": "separtila.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133817",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4939-8a3c-45e1-a288-a574950d210b",
|
|
"value": "158.76.160.100"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133817",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4939-1dd4-45a9-8c28-a574950d210b",
|
|
"value": "standardbay.net"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133818",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f493a-2950-4a19-ad66-a574950d210b",
|
|
"value": "100.134.242.235"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133818",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f493a-0770-4742-90c8-a574950d210b",
|
|
"value": "streamingadv.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133818",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f493a-f480-462e-987d-a574950d210b",
|
|
"value": "124.3.139.20"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133819",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f493b-837c-4a28-be0c-a574950d210b",
|
|
"value": "ternations.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133819",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f493b-6f9c-44c4-a3cd-a574950d210b",
|
|
"value": "25.20.33.76"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133820",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f493c-c4d4-425f-b640-a574950d210b",
|
|
"value": "thomaslaid.net"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133820",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f493c-9ed8-40a8-b025-a574950d210b",
|
|
"value": "189.140.10.37"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133821",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f493d-d99c-4ab0-ac8b-a574950d210b",
|
|
"value": "traffictradexpert.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133821",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f493d-0dec-43da-9d7c-a574950d210b",
|
|
"value": "59.228.144.104"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133821",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f493d-a4a0-4dea-a6ff-a574950d210b",
|
|
"value": "twicecitizens.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133822",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f493e-39a0-411b-8cdf-a574950d210b",
|
|
"value": "veristats.net"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133822",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f493e-10b4-456e-813d-a574950d210b",
|
|
"value": "29.205.223.64"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133823",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f493f-896c-40a7-876f-a574950d210b",
|
|
"value": "virtualsearches.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133823",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f493f-1e18-4455-a47b-a574950d210b",
|
|
"value": "workerssan.net"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133823",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f493f-cf10-4cac-acec-a574950d210b",
|
|
"value": "118.15.53.129"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133824",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "566f4940-0f90-40a2-a186-a574950d210b",
|
|
"value": "yaltimate.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133824",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4940-cbc0-4809-9558-a574950d210b",
|
|
"value": "22.149.159.105"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133825",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4941-be10-41f3-a73c-a574950d210b",
|
|
"value": "182.62.211.45"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133825",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4941-8d9c-43fb-8914-a574950d210b",
|
|
"value": "185.17.184.249"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133826",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4942-6748-48f4-8beb-a574950d210b",
|
|
"value": "214.66.10.71"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133826",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4942-4e20-42df-8b92-a574950d210b",
|
|
"value": "217.23.3.243"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133826",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4942-9390-4e12-9078-a574950d210b",
|
|
"value": "217.23.3.244"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133827",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4943-1198-4243-9df9-a574950d210b",
|
|
"value": "217.23.3.249"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133827",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4943-eb2c-4777-9228-a574950d210b",
|
|
"value": "232.187.207.67"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133828",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4944-0938-4d41-8c14-a574950d210b",
|
|
"value": "26.252.164.23"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133828",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4944-5ce0-41fa-8855-a574950d210b",
|
|
"value": "28.16.103.211"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133829",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4945-eb80-4fd6-85b5-a574950d210b",
|
|
"value": "62.212.68.230"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133829",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4945-e9c0-4410-9726-a574950d210b",
|
|
"value": "78.109.28.248"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133829",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4945-7a10-466a-b35f-a574950d210b",
|
|
"value": "78.109.28.249"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133830",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4946-520c-4e8c-8c97-a574950d210b",
|
|
"value": "78.109.28.250"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133830",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4946-32cc-40e1-a3a8-a574950d210b",
|
|
"value": "85.17.133.193"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133831",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4947-6110-46df-a4b4-a574950d210b",
|
|
"value": "85.17.133.194"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133831",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4947-a48c-48ba-a634-a574950d210b",
|
|
"value": "89.172.227.240"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133831",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4947-c270-4f19-a6b0-a574950d210b",
|
|
"value": "93.115.88.220"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133832",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4948-e190-4846-93fa-a574950d210b",
|
|
"value": "95.211.240.193"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133832",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "566f4948-abdc-4d25-a330-a574950d210b",
|
|
"value": "95.211.240.194"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133868",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "566f496c-d368-415d-aad6-ad1a950d210b",
|
|
"value": "https://malwrpost.wordpress.com/2015/12/03/ioc-from-ponmocup-malware-part-1/"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1450133882",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "566f497a-c538-4970-94ed-7eb5950d210b",
|
|
"value": "Ponmocup"
|
|
}
|
|
]
|
|
}
|
|
} |