1580 lines
No EOL
49 KiB
JSON
1580 lines
No EOL
49 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2015-06-17",
|
|
"extends_uuid": "",
|
|
"info": "OSINT Poseidon And Backoff Pos \u00e2\u20ac\u201c The Links And Similarities by Team Cymru",
|
|
"publish_timestamp": "1456869835",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1434714898",
|
|
"uuid": "558401d3-130c-44db-a49a-42fa950d210b",
|
|
"Orgc": {
|
|
"name": "CthulhuSPRL.be",
|
|
"uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#ffffff",
|
|
"name": "tlp:white"
|
|
},
|
|
{
|
|
"colour": "#004646",
|
|
"name": "type:OSINT"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "Original",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714881",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "558401ed-4b28-4d86-86ff-777a950d210b",
|
|
"value": "https://blog.team-cymru.org/2015/06/poseidon-and-the-backoff-pos-link/"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714616",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "558401f8-2f10-4f02-b885-3c43950d210b",
|
|
"value": "Poseidon"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714616",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "558401f8-59f0-41e3-a865-3c43950d210b",
|
|
"value": "Backoff"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714675",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840233-f934-48c2-b1bc-418f950d210b",
|
|
"value": "https://Askyourspace.com/ldl01aef/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714675",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840233-e038-46fd-8df4-404b950d210b",
|
|
"value": "https://firstcupworlds.com/ldl01zeg/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714676",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840234-7bc0-4b67-b901-4a45950d210b",
|
|
"value": "https://followhell.ru/ldl01z/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714676",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840234-1358-4c99-a842-4f9b950d210b",
|
|
"value": "https://gorestforus.ru/ldl01987/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714676",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840234-f108-43ea-9e28-4d61950d210b",
|
|
"value": "https://lacdileftre.ru/pes2/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714676",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840234-3488-41b1-9207-47d1950d210b",
|
|
"value": "https://linturefa.com/ldl01/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714676",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840234-f124-4476-b097-4dd9950d210b",
|
|
"value": "https://linturefa.ru/ldl01/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714676",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840234-e688-4c41-8f8a-45ea950d210b",
|
|
"value": "https://mehanistran.com/ldl01/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714676",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840234-6350-474b-a5e6-4399950d210b",
|
|
"value": "https://mifastubiv.ru/ldl01/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714676",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840234-9ca8-471d-8a60-4470950d210b",
|
|
"value": "https://petronasconn.ru/ldl01/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714677",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840235-b9fc-42d6-968f-4bf1950d210b",
|
|
"value": "https://queryforworld.com/ldl01/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714677",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840235-aeb8-459c-9104-4d3a950d210b",
|
|
"value": "https://restavratormira.ru/ldl01/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714677",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840235-43a0-4f52-be8f-45b9950d210b",
|
|
"value": "https://serfilefnom.ru/ldl01/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714677",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840235-d998-4fcc-81c5-49de950d210b",
|
|
"value": "https://serppoglandam.ru/ldl01/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714677",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840235-ac40-4f29-8cbe-4c91950d210b",
|
|
"value": "https://servelatmiru.com/ldl01/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714677",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840235-d234-42d3-ac82-4344950d210b",
|
|
"value": "https://spartanwore.com/ldl01srf/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714677",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840235-61bc-42fd-8468-4a3b950d210b",
|
|
"value": "https://srachechno.com/ldl01/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714678",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840236-ff84-4bd9-a899-45a3950d210b",
|
|
"value": "https://switlawert.com/ldl01/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714678",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840236-2874-4cd4-99ed-42c3950d210b",
|
|
"value": "https://tabidzuwek.com/ldl01/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714678",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840236-7ea8-4805-995e-408e950d210b",
|
|
"value": "https://tabidzuwek.ru/ldl01/index.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714678",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840236-6c4c-4c83-b91d-474a950d210b",
|
|
"value": "https://tabidzuwek.ru/ldl01/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714678",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840236-f280-4ffc-9658-44df950d210b",
|
|
"value": "https://vesnarusural.ru/ldl01/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714678",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840236-53cc-42fb-9de6-4fa5950d210b",
|
|
"value": "https://weksrubaz.ru/ldl01/index.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714678",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840236-7dfc-4387-8151-4cdf950d210b",
|
|
"value": "https://weksrubaz.ru/ldl01/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714678",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840236-1c9c-48e9-990b-4d99950d210b",
|
|
"value": "https://wertstumbahn.ru/ldl01/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714679",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840237-3634-40de-b3b1-4dbf950d210b",
|
|
"value": "https://xablopefgr.com/ldl01/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714679",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840237-707c-4fa2-abbc-4e50950d210b",
|
|
"value": "https://xablopefgr.ru/ldl01/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714679",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "55840237-93dc-4fae-8365-47a4950d210b",
|
|
"value": "/ldl01/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714702",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5584024e-1a98-491e-97ab-44e7950d210b",
|
|
"value": "46.30.41.159"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714702",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5584024e-3334-48a1-a34d-40b0950d210b",
|
|
"value": "46.166.168.106"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714702",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5584024e-8f88-4b9f-b3eb-42be950d210b",
|
|
"value": "89.144.2.148"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714703",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5584024f-0b64-4c18-8939-491a950d210b",
|
|
"value": "89.144.2.149"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714703",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5584024f-6b54-4a87-9a68-464b950d210b",
|
|
"value": "89.144.2.150"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714703",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5584024f-7224-4143-bcb6-4601950d210b",
|
|
"value": "93.171.202.168"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714703",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5584024f-c364-4d74-9e3d-4371950d210b",
|
|
"value": "146.120.110.104"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714703",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5584024f-fa88-4095-bac0-47fa950d210b",
|
|
"value": "162.244.32.164"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714703",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5584024f-80b0-495a-a48f-41b7950d210b",
|
|
"value": "178.62.208.238"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714703",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5584024f-de54-42d4-8047-4da7950d210b",
|
|
"value": "193.230.220.53"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714703",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5584024f-024c-4d70-ade5-4df3950d210b",
|
|
"value": "216.246.98.85"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714747",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5584027b-fb88-48cd-8089-4d30950d210b",
|
|
"value": "164af045a08d718372dd6ecd34b746e7032127b1"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714747",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5584027b-5e68-4ea8-8e64-4285950d210b",
|
|
"value": "d5ac494c02f47d79742b55bb9826363f1c5a656c"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714747",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5584027b-8b00-4fc9-a7c8-4d58950d210b",
|
|
"value": "05b124b5f33a65ebb7489cdbcb55eee1692049f3"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714747",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5584027b-dfb0-4708-803d-4ee1950d210b",
|
|
"value": "5e70840747264adee10bb298262207c8c25cff40"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714747",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5584027b-d49c-4a3d-a853-432f950d210b",
|
|
"value": "3de607115b6f0372ad9d4d68c27a118eca463a11"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714747",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5584027b-a2d8-44d6-abbc-4d7d950d210b",
|
|
"value": "4959d2bdb93f2a75fd92ebbb1de391e3ed72ac55"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714748",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5584027c-01d4-48a6-aa02-4d65950d210b",
|
|
"value": "b542f06b600e4caf2c3089a1ebb3a68d9d0a8003"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714748",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5584027c-83e8-42f7-bb2d-4197950d210b",
|
|
"value": "8cfbfa37d31bcdeba00f0cab1509f93feec43e37"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714748",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5584027c-8150-4c6d-89a1-4495950d210b",
|
|
"value": "0d9a8b1c179e705f589f84a4ee3d635fe4ecf4f6"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714748",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5584027c-8c38-4201-9162-4ef5950d210b",
|
|
"value": "1be1781de69d6d6e8e749538c28dd0a5bff9a2bb"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714748",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5584027c-9164-4af3-8ae7-40b6950d210b",
|
|
"value": "2b53394dad68bfc2a22d710259cb922d44799282"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714748",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5584027c-83a8-45f8-a635-498e950d210b",
|
|
"value": "8b83112e29b4c51ad5e63c4e7c4dc3cd6065e6d7"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714748",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5584027c-63d8-4bda-8638-424f950d210b",
|
|
"value": "1a7f93af47c4ddd9e9c52e39d6b388ce6bc86a7f"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714749",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5584027d-ab24-410f-a38c-4559950d210b",
|
|
"value": "6e45ba4be815ee0f2f8954a05b3f79ffa52bbce2"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714749",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5584027d-ee40-4d99-baf1-4803950d210b",
|
|
"value": "8b2455854fdd9907c601a4b00703f9aa6ec62408"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714749",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5584027d-aa6c-4ee8-9dbc-4b40950d210b",
|
|
"value": "47430cf79c6d01abe6630e4c08d3fc821040069e"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714749",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5584027d-364c-4099-acb3-4b68950d210b",
|
|
"value": "7dd0e3ae8bd7a69789d6117fb3e64926e4baad53"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714749",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5584027d-47f0-441e-845d-4e2e950d210b",
|
|
"value": "82189618784f98846bac2139ebe3d3839fe855e9"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714749",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5584027d-14e8-4706-ba4b-49d6950d210b",
|
|
"value": "11b3a6866c153c0ed266b5d6e151217299fba3ac"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714749",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5584027d-f864-402c-94d2-43e9950d210b",
|
|
"value": "837ac1eaea0ae07fda97e659d55996d09d8485da"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714749",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5584027d-a188-4a70-b151-4239950d210b",
|
|
"value": "1770d90d828b01a46ab4e39257db28f0a00f2cd8"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714750",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5584027e-86b4-4ca7-8159-4e07950d210b",
|
|
"value": "02a39351450616c624a7d06ae2e91fbad2515bfd"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714750",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5584027e-aad0-453f-a08b-4f0d950d210b",
|
|
"value": "415132ffccbb95856db3acb3c3648244864a0586"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Loader",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714750",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5584027e-3edc-4f37-b415-46cd950d210b",
|
|
"value": "bc244f41938cbdc419590b34f74b8f4a88a73104"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714813",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "558402bd-5260-4854-be21-3c43950d210b",
|
|
"value": "http://apporistale.com/pes18/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714813",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "558402bd-f788-458f-b534-3c43950d210b",
|
|
"value": "http://dingdownmahedt.ru/pes18/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714813",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "558402bd-caa4-4a7b-8967-3c43950d210b",
|
|
"value": "http://dinghareun.ru/pes18/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714813",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "558402bd-3034-4b0a-98f6-3c43950d210b",
|
|
"value": "http://dreplicag.ru/pes13/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714814",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "558402be-1650-40a4-b2f3-3c43950d210b",
|
|
"value": "http://ferepritdi.ru/pes18/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714814",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "558402be-ef7c-4275-af7f-3c43950d210b",
|
|
"value": "http://fimzusoln.ru/pes13/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714814",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "558402be-b3c0-429a-a0fa-3c43950d210b",
|
|
"value": "http://horticartf.com/pes13/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714814",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "558402be-6ca8-4ef2-b9bd-3c43950d210b",
|
|
"value": "http://howthatficy.ru/pes19/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714814",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "558402be-ba80-4838-bb51-3c43950d210b",
|
|
"value": "http://kilaxuntf.ru/pes13/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714814",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "558402be-5dc8-4fdf-8ea9-3c43950d210b",
|
|
"value": "http://lasttrainforest.com/pes19/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714814",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "558402be-6b98-4a9d-9c18-3c43950d210b",
|
|
"value": "http://newdomainreservenow.ru/pes9/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714814",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "558402be-c43c-4e18-8fb1-3c43950d210b",
|
|
"value": "http://p9yhenm.ru/pes9/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714815",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "558402bf-5710-406f-8961-3c43950d210b",
|
|
"value": "http://quartlet.com/pes13/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714815",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "558402bf-cbe4-420a-9a81-3c43950d210b",
|
|
"value": "http://rabbutdownlitt.ru/pes19/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714815",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "558402bf-c034-4e5f-bdbf-3c43950d210b",
|
|
"value": "http://refherssuce.ru/pes19/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714815",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "558402bf-5b6c-42ef-bb00-3c43950d210b",
|
|
"value": "http://reswahatce.ru/pes19/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714815",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "558402bf-af80-4867-85f7-3c43950d210b",
|
|
"value": "http://terethaundv.ru/pes18/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714815",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "558402bf-e4e8-478d-9a78-3c43950d210b",
|
|
"value": "http://wetguqan.ru/pes13/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714815",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "558402bf-c878-4e46-b3a5-3c43950d210b",
|
|
"value": "http://xoftunhbyirf.tk/pes18/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714815",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "558402bf-eb84-409a-a91f-3c43950d210b",
|
|
"value": "/pes18/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714816",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "558402c0-f4ac-4853-b9f2-3c43950d210b",
|
|
"value": "/pes13/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714816",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "558402c0-c8c8-4146-8d67-3c43950d210b",
|
|
"value": "/pes19/viewtopic.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714833",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "558402d1-1168-4081-9764-40cb950d210b",
|
|
"value": "46.161.40.106"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714833",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "558402d1-8728-4c63-b666-4bb0950d210b",
|
|
"value": "89.144.2.151"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714833",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "558402d1-5db0-450a-8238-4531950d210b",
|
|
"value": "91.220.131.182"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714834",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "558402d2-7fa4-45b2-9092-40c4950d210b",
|
|
"value": "128.199.73.152"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714854",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e6-46b8-4b66-bd40-48ae950d210b",
|
|
"value": "16cc234cdd9b180801e79d0b4beb0d88462911c0"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714854",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e6-fdc8-488e-bada-4215950d210b",
|
|
"value": "0417922ec0503730297c167abcefcb4bdadcf8d8"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714854",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e6-352c-4410-a787-44ee950d210b",
|
|
"value": "5531d79887f9fd8491596c4ac39a46e2df3e3b19"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714854",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e6-bc9c-4373-8e9a-4407950d210b",
|
|
"value": "f3420cb99c4689bd613f8195571f5dcb417e6d22"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714854",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e6-2ef8-4a02-a503-4467950d210b",
|
|
"value": "0e8827796ea18b18891a2015bc000776664ebff4"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714854",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e6-6e9c-4dc1-8ef3-4471950d210b",
|
|
"value": "17a2c61bf5c49d465a527625cd3e73c60afc07a4"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714854",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e6-9574-4658-b57d-4262950d210b",
|
|
"value": "1c22a10c198257316a41e3f7d6f8ad4c40f05e5d"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714855",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e7-c3b0-4ced-817d-4d96950d210b",
|
|
"value": "21ef25799050ca8360cb6f8679fc90bd9af8a9de"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714855",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e7-87f8-4af2-b84d-4c0e950d210b",
|
|
"value": "24ddc01f6446f3970fb1b895cb7fced9d9ab6328"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714855",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e7-0cd0-4cd3-ac41-473c950d210b",
|
|
"value": "26495828c9a7bb33328b54f772fb1bbd06f6106e"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714855",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e7-1678-44f1-88ea-40ac950d210b",
|
|
"value": "29c29b4d3b81d054dc1d4adea63d606e04663c95"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714855",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e7-04fc-4d68-9e38-4d62950d210b",
|
|
"value": "2d29baaebaf719d284a9ee4eb0192934ae0f91ce"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714855",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e7-9d04-4d47-9b85-403c950d210b",
|
|
"value": "303ced5245f0efe080a945d269ec94b2972cbee6"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714855",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e7-827c-4c6d-9806-46d6950d210b",
|
|
"value": "31a7ae4d92cf742f447396a197a5ba722e672f05"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714855",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e7-d76c-4921-920f-4ab9950d210b",
|
|
"value": "3a800f25408c679f337b6899dca137db66fead66"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714856",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e8-5a50-4277-a1a2-4059950d210b",
|
|
"value": "3c97379ea625a584b91c63b8d9286d6182d61ea2"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714856",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e8-b1a8-4cfd-8d44-4f66950d210b",
|
|
"value": "40eb76aa1c1cd58db621cf21d27b26b33cce5f8a"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714856",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e8-3efc-49c1-a9da-4a3b950d210b",
|
|
"value": "41a1c644af30dc4caae59a22dc94bed18e8736de"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714856",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e8-70e0-43c3-af50-43bf950d210b",
|
|
"value": "47eda908dd3757d66409e6f3a6225ca1cd03fa2c"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714856",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e8-2c18-488a-abbb-49b4950d210b",
|
|
"value": "66244a0d24231839333e8ce970b6ab1b3ad469b7"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714856",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e8-996c-4d8b-b376-4e3f950d210b",
|
|
"value": "6f6dc9f09c593a57cf9ef658d2447da9c56fbbb4"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714856",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e8-1eb4-4376-90de-48bc950d210b",
|
|
"value": "723af5e6d126021aa0d8032a4cc45da5bedbe946"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714856",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e8-1780-4e73-bb89-44c4950d210b",
|
|
"value": "7915d8736770d4ead4c10304bd54ad72a1120afe"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714857",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e9-fe50-472d-a268-4e02950d210b",
|
|
"value": "884f02ea7e0da210a3d62a347a43c0079cb5218a"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714857",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e9-2420-473f-822f-424d950d210b",
|
|
"value": "8ab3bd0c323ef967245bd7756070733f3386eb45"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714857",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e9-ac18-4393-9718-4612950d210b",
|
|
"value": "8f57a662898f5eec84b9fd06da21354184c67f5d"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714857",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e9-c654-4d94-af7e-4635950d210b",
|
|
"value": "9391c66dd409a2908c54f573c975d1a2053f5b8e"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714857",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e9-a140-4462-bf4c-4991950d210b",
|
|
"value": "aa90a93833cb1171e9e213ba73928d32c546c1fd"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714857",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e9-8e94-483b-8749-4228950d210b",
|
|
"value": "aded4e686227c932c77fe158ec18251aad4d7097"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714857",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402e9-39d8-4577-a33b-48a7950d210b",
|
|
"value": "ba983efd45dc4a21c34a9be4273fd82d27768267"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714858",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402ea-9524-4d8e-b5fc-41a8950d210b",
|
|
"value": "bad699af3fc8fda8e8cd271aac8a018c5faa3748"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714858",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402ea-6e68-432a-8130-4e27950d210b",
|
|
"value": "c0c6fd8b23e627188814cd36ea7a6a5d9f1391e8"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714858",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402ea-fb74-4582-9e2f-4509950d210b",
|
|
"value": "c3120212263c7d272b5664fbd33291d46f5357ea"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714858",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402ea-04b8-4e3d-a598-4092950d210b",
|
|
"value": "c78130f95c4c4db31585521ce4668f962b7385df"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714858",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402ea-95ac-4808-ad14-4b71950d210b",
|
|
"value": "d28c053075b2636e8b217f439f15565abe26f569"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714858",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402ea-e4f8-4d3d-952d-48e2950d210b",
|
|
"value": "e0158ac0ced198dad89220c2063bbfed515f60fc"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714858",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402ea-a16c-445e-aa00-4c90950d210b",
|
|
"value": "e51ac9b4180ed0045e690dd09bfe3a69af3b8a0c"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714858",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402ea-dc28-4a1c-a58d-47f4950d210b",
|
|
"value": "edb3a9ab30702d1750a3ec5cfd37893af329e788"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714859",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402eb-fe08-43bf-8c64-4e9b950d210b",
|
|
"value": "f1dca78808b7f32ef817bd36e2b250e9c7d736b6"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Exfiltration",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714859",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "558402eb-36dc-46c3-9955-4c7c950d210b",
|
|
"value": "f562eaed7ddbfb1eee7e95417b54556cabd55c36"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714898",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "55840312-18e0-404b-a13e-40bf950d210b",
|
|
"value": "http://blogs.cisco.com/security/talos/poseidon"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714898",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "55840312-5738-459a-b098-4c47950d210b",
|
|
"value": "https://blogs.rsa.com/attacking-a-pos-supply-chain-part-1/"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1434714898",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "55840312-c6b0-4b62-a413-43c5950d210b",
|
|
"value": "https://live.paloaltonetworks.com/community/kb/blog/2015/03/25/findpos-new-pos-malware-family-discovered"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 8cfbfa37d31bcdeba00f0cab1509f93feec43e37)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455841101",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "56c65f4d-5d64-4d16-86ac-59a0950d210f",
|
|
"value": "f4a4e8d2c64e0b739c9c0d2ad8c974fa"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 16cc234cdd9b180801e79d0b4beb0d88462911c0)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455841106",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "56c65f52-0110-4e54-ade3-42d6950d210f",
|
|
"value": "84f001ad1d9d54b4c4a841ea325fb709"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 723af5e6d126021aa0d8032a4cc45da5bedbe946)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455841109",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "56c65f55-2930-47fa-9f20-59a4950d210f",
|
|
"value": "657151a09c4c7de7df5b646f82458359"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 8cfbfa37d31bcdeba00f0cab1509f93feec43e37)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455841102",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "56c65f4e-e92c-431e-a309-40f2950d210f",
|
|
"value": "fd248aea67c258190bfd1a7b7c2921a41ecb54658ec61c36b74225bb45718dae"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 16cc234cdd9b180801e79d0b4beb0d88462911c0)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455841106",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "56c65f52-bfa4-4fee-a945-4083950d210f",
|
|
"value": "28ca8bd8a86a3f7f3e501c4dcdf5476f9bda4bbfb91143958d5b168fc15eb391"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Automatically added (via 723af5e6d126021aa0d8032a4cc45da5bedbe946)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455841110",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "56c65f56-c348-471c-a9b9-475b950d210f",
|
|
"value": "7fc34118034db941a4aaeaecc3bf0bbdb415a070b2fcedd225adc11f970c7037"
|
|
}
|
|
]
|
|
}
|
|
} |