1727 lines
No EOL
58 KiB
JSON
1727 lines
No EOL
58 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2015-12-09",
|
|
"extends_uuid": "",
|
|
"info": "OSINT - Packrat: Seven Years of a South American Threat Actor",
|
|
"publish_timestamp": "1483098922",
|
|
"published": true,
|
|
"threat_level_id": "2",
|
|
"timestamp": "1483098905",
|
|
"uuid": "5667e3ea-cec4-4a67-b7c0-f7a9950d210b",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#004646",
|
|
"name": "type:OSINT"
|
|
},
|
|
{
|
|
"colour": "#ffffff",
|
|
"name": "tlp:white"
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"name": "misp-galaxy:threat-actor=\"Packrat\""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649153",
|
|
"to_ids": false,
|
|
"type": "comment",
|
|
"uuid": "5667e401-6e9c-4eb3-98e1-f81b950d210b",
|
|
"value": "This report describes an extensive malware, phishing, and disinformation campaign active in several Latin American countries, including Ecuador, Argentina, Venezuela, and Brazil. The nature and geographic spread of the targets seems to point to a sponsor, or sponsors, with regional, political interests. The attackers, whom we have named Packrat, have shown a keen and systematic interest in the political opposition and the independent press in so-called ALBA countries (Bolivarian Alternative for the Americas), and their recently allied regimes. These countries are linked by a trade agreement as well as a cooperation on a range of non-financial matters.\r\n\r\nAfter observing a wave of attacks in Ecuador in 2015, we linked these attacks to a campaign active in Argentina in 2014. The targeting in Argentina was discovered when the attackers attempted to compromise the devices of Alberto Nisman and Jorge Lanata. Building on what we had learned about these two campaigns, we then traced the group\u00e2\u20ac\u2122s activities back as far as 2008.\r\n\r\nThis report brings together many of the pieces of this campaign, from malware and phishing, to command and control infrastructure spread across Latin America. It also highlights fake online organizations that Packrat has created in Venezuela and Ecuador. Who is responsible? We assess several scenarios, and consider the most likely to be that Packrat is sponsored by a state actor or actors, given their apparent lack of concern about discovery, their targets, and their persistence. However, we do not conclusively attribute Packrat to a particular sponsor."
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649168",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5667e410-8d30-43cf-9b1d-f960950d210b",
|
|
"value": "https://citizenlab.org/2015/12/packrat-report/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649234",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5667e452-3bf8-471b-acf8-a716950d210b",
|
|
"value": "dd1101adc86fd282f5f183942cc2f3b7"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649235",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e453-96b0-4ea7-8fa9-a716950d210b",
|
|
"value": "wjwj.no-ip.org"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649235",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e453-d6a8-4f26-9595-a716950d210b",
|
|
"value": "ruley.no-ip.org"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649235",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e453-9844-4a09-8210-a716950d210b",
|
|
"value": "lolinha.no-ip.org"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649236",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5667e454-d170-4f35-b5ab-a716950d210b",
|
|
"value": "2d722592a4e3c8030410dccccb221ce4"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649236",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5667e454-8938-4b22-b5b9-a716950d210b",
|
|
"value": "d2adecc6287dd4d559fe6ce2ce7a7e31"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649237",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5667e455-95a4-4032-bfeb-a716950d210b",
|
|
"value": "93b630891db21a4a2350280a360c713d"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649237",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5667e455-3cdc-4f27-bc4b-a716950d210b",
|
|
"value": "a73351623577f44a2b578fed1e78e37e"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649237",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5667e455-6c28-47e0-8e49-a716950d210b",
|
|
"value": "5a8975873f52436377d8fb0b5ab0d87a"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649238",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5667e456-bd6c-4d1a-8598-a716950d210b",
|
|
"value": "ed8d7ed45b64890b8901b735018318f3"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649238",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5667e456-2854-42f3-aa2e-a716950d210b",
|
|
"value": "c2237e9d415f542ce6e73adb260af123"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649239",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5667e457-44e4-48b8-8e12-a716950d210b",
|
|
"value": "2827450763b55c5e71fda3caaf8e75f9"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649239",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5667e457-474c-45c8-bdaf-a716950d210b",
|
|
"value": "bc97437fec7e7e8634c2eabae3cc4832"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649239",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e457-9a50-4638-8336-a716950d210b",
|
|
"value": "taskmgr.serveftp.com"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649240",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5667e458-d6ac-4a1e-818e-a716950d210b",
|
|
"value": "d7f34168b1a7dd7cbd8e62a5ab1ebc0e"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649240",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e458-ddf4-46db-975f-a716950d210b",
|
|
"value": "taskmgr.servehttp.com"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649241",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5667e459-e850-4104-bb40-a716950d210b",
|
|
"value": "6c34d4296126679d9c6a0bc2660dc453"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649241",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5667e459-43b4-4d18-8872-a716950d210b",
|
|
"value": "efc0009d76a2057f86c5f00030378c72"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649241",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e459-983c-43e3-957e-a716950d210b",
|
|
"value": "daynews.sytes.net"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649242",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5667e45a-9ad4-4a75-884a-a716950d210b",
|
|
"value": "74613eae84347183b4ca61b912a4573f"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649242",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5667e45a-1054-4477-8565-a716950d210b",
|
|
"value": "d2f151312f7dee2483ddcab9766b56db"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649243",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5667e45b-a24c-450f-88c8-a716950d210b",
|
|
"value": "ea7bcf58a4ccdecb0c64e56b9998a4ac"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649243",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5667e45b-406c-4a1e-a719-a716950d210b",
|
|
"value": "1e4265a0c37773c2372b97bb6630ae57"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649243",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5667e45b-f2fc-4b3a-a444-a716950d210b",
|
|
"value": "08a3bb5b220eb1e0dc2ecccbbc6859f5"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649279",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5667e47f-5094-40f4-9c1a-f960950d210b",
|
|
"value": "198.12.150.249"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Suspicious domains registered by enripintos123@outlook.es",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649320",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e4a8-1b1c-48b6-9795-f81b950d210b",
|
|
"value": "support-java.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Suspicious domains registered by enripintos123@outlook.es",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649320",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e4a8-71a0-40f7-b18e-f81b950d210b",
|
|
"value": "lavozamericana.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Suspicious domains registered by enripintos123@outlook.es",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649321",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e4a9-0a2c-497f-b668-f81b950d210b",
|
|
"value": "login-office365.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Suspicious domains registered by enripintos123@outlook.es",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649321",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e4a9-f478-42aa-b3aa-f81b950d210b",
|
|
"value": "support-whatsapp.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Suspicious domains registered by enripintos123@outlook.es",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649322",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e4aa-20e4-41ef-ba84-f81b950d210b",
|
|
"value": "mgoogle.us"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Suspicious domains registered by enripintos123@outlook.es",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649322",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e4aa-4a54-40ef-aefd-f81b950d210b",
|
|
"value": "android-flash.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Suspicious domains registered by enripintos123@outlook.es",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649322",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e4aa-bf4c-4fd9-93cc-f81b950d210b",
|
|
"value": "pancaliente.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Suspicious domains registered by enripintos123@outlook.es",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649323",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e4ab-dd04-49c9-bd1a-f81b950d210b",
|
|
"value": "soporte-gmail.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Suspicious domains registered by enripintos123@outlook.es",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649323",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e4ab-a764-4673-9d1b-f81b950d210b",
|
|
"value": "soporte-yahoo.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Suspicious domains registered by enripintos123@outlook.es",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649324",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e4ac-d7c8-4e98-ae7a-f81b950d210b",
|
|
"value": "autorizacion-gmail.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Suspicious domains registered by enripintos123@outlook.es",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649324",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e4ac-aa0c-4669-9241-f81b950d210b",
|
|
"value": "support-gmail.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Suspicious domains registered by enripintos123@outlook.es",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649325",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e4ad-92fc-4ba3-b301-f81b950d210b",
|
|
"value": "login-outlook.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Suspicious domains registered by enripintos123@outlook.es",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649325",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e4ad-1784-4d65-8e7f-f81b950d210b",
|
|
"value": "logon-outlook.com"
|
|
},
|
|
{
|
|
"category": "Attribution",
|
|
"comment": "Whois record (registrant)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649353",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5667e4c9-549c-4a4f-8db4-e992950d210b",
|
|
"value": "enripintos123@outlook.es"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "193.105.134.27",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649378",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e4e2-db00-4452-ae1e-edb5950d210b",
|
|
"value": "support-login-validate-outlook.tk"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "193.105.134.27",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649379",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e4e3-42e0-4ffc-b9e7-edb5950d210b",
|
|
"value": "verify-gmail-support-secure.tk"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "193.105.134.27",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649379",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e4e3-0958-4c15-aae1-edb5950d210b",
|
|
"value": "soporte-login-account-gmail.tk"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "193.105.134.27",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649380",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e4e4-0b54-4931-b663-edb5950d210b",
|
|
"value": "soporte-login-account-yahoo.tk"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "193.105.134.27",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649380",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e4e4-b994-4df8-98ee-edb5950d210b",
|
|
"value": "focusecuador.tk"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "193.105.134.27",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649380",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e4e4-caa8-4af6-ae94-edb5950d210b",
|
|
"value": "1.update-outlook.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "193.105.134.27",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649381",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e4e5-08d0-4fe7-89ac-edb5950d210b",
|
|
"value": "2.update-outlook.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "193.105.134.27",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649381",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e4e5-f194-43f2-ad6d-edb5950d210b",
|
|
"value": "1.desk-yahoo.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "193.105.134.27",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649382",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e4e6-922c-4cc7-a8b5-edb5950d210b",
|
|
"value": "2.desk-yahoo.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "193.105.134.27",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649382",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e4e6-2b24-4264-b41c-edb5950d210b",
|
|
"value": "2.mlogin-outlook.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "193.105.134.27",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649382",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e4e6-903c-42b2-8477-edb5950d210b",
|
|
"value": "1.mlogin-outlook.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "193.105.134.27",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649383",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e4e7-6978-4808-b4e8-edb5950d210b",
|
|
"value": "1.soporte-google.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "193.105.134.27",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649383",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e4e7-995c-46eb-8f36-edb5950d210b",
|
|
"value": "2.soporte-google.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "193.105.134.27",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649384",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e4e8-c328-4a10-a6d6-edb5950d210b",
|
|
"value": "mlogin-outlook.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "193.105.134.27",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649384",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e4e8-cbf8-4379-844e-edb5950d210b",
|
|
"value": "ns2.mlogin-outlook.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "193.105.134.27",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649384",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e4e8-cdc4-43b0-a73e-edb5950d210b",
|
|
"value": "ns1.mlogin-outlook.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649415",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e507-0344-4359-a157-f960950d210b",
|
|
"value": "soporte-yahoo.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649416",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e508-ca08-4949-9e4b-f960950d210b",
|
|
"value": "update-outlook.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649416",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e508-90a4-4701-b9f8-f960950d210b",
|
|
"value": "deyrep.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649417",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e509-bd5c-4596-a28b-f960950d210b",
|
|
"value": "support-whatsapp.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649417",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e509-545c-4ba7-bc6b-f960950d210b",
|
|
"value": "blackboxmusic.co"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649418",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e50a-daf4-455a-a8a9-f960950d210b",
|
|
"value": "www.blackboxmusic.co"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649419",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e50b-ab48-4dc1-86fa-f960950d210b",
|
|
"value": "mail-account-update.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649419",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e50b-6a9c-480c-9242-f960950d210b",
|
|
"value": "soporte-gmail.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649420",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e50c-3ccc-475a-b15a-f960950d210b",
|
|
"value": "login-office365.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649420",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e50c-cddc-4309-b155-f960950d210b",
|
|
"value": "lavozmericana.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649421",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e50d-793c-4a5a-a478-f960950d210b",
|
|
"value": "support-java.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649421",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e50d-f5ec-42ed-8ac6-f960950d210b",
|
|
"value": "pancaliente.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649422",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e50e-e410-459a-b2ed-f960950d210b",
|
|
"value": "logon-outlook.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649422",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e50e-e490-40e2-bd98-f960950d210b",
|
|
"value": "movimientoanticorreista.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649423",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e50f-6db0-4064-bd55-f960950d210b",
|
|
"value": "mgoogle.us"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649424",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e510-02bc-493c-8240-f960950d210b",
|
|
"value": "lavozamericana.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649425",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e511-e4e8-4892-9027-f960950d210b",
|
|
"value": "n3.pancaliente.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649425",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e511-7824-4f52-a52d-f960950d210b",
|
|
"value": "n4.pancaliente.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649425",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e511-6ac0-4635-bd58-f960950d210b",
|
|
"value": "ns1.deyrep.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649426",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e512-9bbc-4cb6-8288-f960950d210b",
|
|
"value": "ns2.deyrep.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649426",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e512-3624-4358-9bc6-f960950d210b",
|
|
"value": "n1.login-office365.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649427",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e513-7340-49f8-ae5f-f960950d210b",
|
|
"value": "n2.login-office365.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649427",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e513-5658-4783-8e49-f960950d210b",
|
|
"value": "1.lavozamericana.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649427",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e513-4720-48ae-87fc-f960950d210b",
|
|
"value": "2.lavozamericana.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649428",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e514-abc4-4173-b18e-f960950d210b",
|
|
"value": "n1.update-outlook.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649428",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e514-92a8-424f-98af-f960950d210b",
|
|
"value": "ns.update-outlook.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649429",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e515-1c04-4d03-8b70-f960950d210b",
|
|
"value": "1.chavistas24.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649429",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e515-0730-4e79-9d2c-f960950d210b",
|
|
"value": "2.chavistas24.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649429",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e515-bc58-44a4-88af-f960950d210b",
|
|
"value": "s1.mgoogle.us"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649430",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e516-c4f0-46cb-b238-f960950d210b",
|
|
"value": "s2.mgoogle.us"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "198.12.150.249",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649430",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e516-f010-4bac-8040-f960950d210b",
|
|
"value": "chavistas24.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649467",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5667e53b-3ca4-4eee-bf5d-4e13950d210b",
|
|
"value": "193.105.134.27"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: dd1101adc86fd282f5f183942cc2f3b7",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649527",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5667e577-2274-451b-9464-4bb9950d210b",
|
|
"value": "https://www.virustotal.com/file/56ea4781ccefb7596e77fcb7a57fb703007f2fb9b94fe33a3cc5257ab7996d1c/analysis/1449039349/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: 6c34d4296126679d9c6a0bc2660dc453",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649527",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5667e577-20e8-4751-ae33-4a5e950d210b",
|
|
"value": "1f76c2957c2c39ec83a817479dda38c5047d153dbe466c2aabff7b4354e0647f"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: 6c34d4296126679d9c6a0bc2660dc453",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649528",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5667e578-4b0c-4c1e-b926-435c950d210b",
|
|
"value": "8418833e6898e07c8a3124ec79ccb531306830c2"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649528",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5667e578-6fd4-43f7-9b32-443f950d210b",
|
|
"value": "https://www.virustotal.com/file/1f76c2957c2c39ec83a817479dda38c5047d153dbe466c2aabff7b4354e0647f/analysis/1425547957/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: d7f34168b1a7dd7cbd8e62a5ab1ebc0e",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649528",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5667e578-cb50-4d2f-a8f3-420e950d210b",
|
|
"value": "7a763ecc8ab23c3ade2455c2e91b506be910bed686fc3d32acb9574d7d5abf27"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: d7f34168b1a7dd7cbd8e62a5ab1ebc0e",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649529",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5667e579-61e8-4a3a-a281-47ab950d210b",
|
|
"value": "a5864e9eb81755992d16138ddbd1e40c3fef3464"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649529",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5667e579-8a8c-4006-9f0d-444e950d210b",
|
|
"value": "https://www.virustotal.com/file/7a763ecc8ab23c3ade2455c2e91b506be910bed686fc3d32acb9574d7d5abf27/analysis/1406503376/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: bc97437fec7e7e8634c2eabae3cc4832",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649530",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5667e57a-8ff4-4c0c-b502-457a950d210b",
|
|
"value": "cfb7d7c6a5dbda5737e492bb2bacfecd975a4c0977050184a948dd5c25ab8b7d"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: bc97437fec7e7e8634c2eabae3cc4832",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649530",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5667e57a-65b0-41b0-a157-490a950d210b",
|
|
"value": "cac350f2d108dfb81e33833d55f19d79a79d8a54"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649531",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5667e57b-d2bc-4d76-ad4c-4686950d210b",
|
|
"value": "https://www.virustotal.com/file/cfb7d7c6a5dbda5737e492bb2bacfecd975a4c0977050184a948dd5c25ab8b7d/analysis/1405023273/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: 2827450763b55c5e71fda3caaf8e75f9",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649531",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5667e57b-31e0-4526-b653-4562950d210b",
|
|
"value": "3c22bcf90b1f94691f9982de6d603f27517799684cbc77e0e1b08e327a0e4c00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: 2827450763b55c5e71fda3caaf8e75f9",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649531",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5667e57b-f5c0-47fd-96f1-4f7d950d210b",
|
|
"value": "6e37f617bd982254d84860987c72bee0fc547fe2"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649532",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5667e57c-d3d8-491e-8b45-4dfe950d210b",
|
|
"value": "https://www.virustotal.com/file/3c22bcf90b1f94691f9982de6d603f27517799684cbc77e0e1b08e327a0e4c00/analysis/1370016723/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: c2237e9d415f542ce6e73adb260af123",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649532",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5667e57c-afb4-40f5-8d26-4310950d210b",
|
|
"value": "6eeb5bcfc5d28ccad251035b11b08d553f7d10e22574209524b71a0dff1dcd3f"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: c2237e9d415f542ce6e73adb260af123",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649533",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5667e57d-6338-46cd-a192-426d950d210b",
|
|
"value": "5784d614d6844343014c8205114c69bb472f1c20"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649533",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5667e57d-54b0-4922-8622-492f950d210b",
|
|
"value": "https://www.virustotal.com/file/6eeb5bcfc5d28ccad251035b11b08d553f7d10e22574209524b71a0dff1dcd3f/analysis/1368784928/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: ed8d7ed45b64890b8901b735018318f3",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649533",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5667e57d-b090-4188-beea-4594950d210b",
|
|
"value": "db6883b0dd7c5d3a23fb9609b087e8494cb08ca9d478878e07d868bf68e52267"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: ed8d7ed45b64890b8901b735018318f3",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649534",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5667e57e-49f0-4e1f-a813-4ced950d210b",
|
|
"value": "c80aebbe1bfd64308f329ceb79ee1b35559581a9"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649534",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5667e57e-b1bc-4e87-ab9e-4352950d210b",
|
|
"value": "https://www.virustotal.com/file/db6883b0dd7c5d3a23fb9609b087e8494cb08ca9d478878e07d868bf68e52267/analysis/1353091550/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: 5a8975873f52436377d8fb0b5ab0d87a",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649535",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5667e57f-c0a8-4481-838f-44ea950d210b",
|
|
"value": "7525af4888f939e7a1df51bb8737a887af0b705d72e89a0b573f35ea57ace888"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: 5a8975873f52436377d8fb0b5ab0d87a",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649535",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5667e57f-b860-4cd8-b8c2-4385950d210b",
|
|
"value": "ddbfabcc9dccf34dd9e50493e9087b3a9cbcea66"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649535",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5667e57f-ee74-4aa4-a678-422e950d210b",
|
|
"value": "https://www.virustotal.com/file/7525af4888f939e7a1df51bb8737a887af0b705d72e89a0b573f35ea57ace888/analysis/1351886880/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: a73351623577f44a2b578fed1e78e37e",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649536",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5667e580-eb28-4342-9146-4dc2950d210b",
|
|
"value": "e125218316467d4749e957b87201f8fd4c4ba14857588d2aca57d94294137a00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: a73351623577f44a2b578fed1e78e37e",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649536",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5667e580-dbf4-497e-b8aa-4ef0950d210b",
|
|
"value": "6606c890794b0243c0d34fa8f09ead02569f0ea4"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649537",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5667e581-0b4c-4284-af44-4a26950d210b",
|
|
"value": "https://www.virustotal.com/file/e125218316467d4749e957b87201f8fd4c4ba14857588d2aca57d94294137a00/analysis/1367977231/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: 93b630891db21a4a2350280a360c713d",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649537",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5667e581-39f8-44d5-89cf-4714950d210b",
|
|
"value": "c10f703839ec0a82a248883b1b8885747b5fb145d0aeb0bad71e06980425a4fa"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: 93b630891db21a4a2350280a360c713d",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649538",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5667e582-f7a0-4922-95c1-48d5950d210b",
|
|
"value": "3b75f27d1bd1c41989b0f5ff3a4e44998eb45609"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649538",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5667e582-f768-4519-b17c-4ea0950d210b",
|
|
"value": "https://www.virustotal.com/file/c10f703839ec0a82a248883b1b8885747b5fb145d0aeb0bad71e06980425a4fa/analysis/1355946685/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: d2adecc6287dd4d559fe6ce2ce7a7e31",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649538",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5667e582-a8fc-47b9-b870-4726950d210b",
|
|
"value": "e17bdf72b3c6c53a3ee77e3edc0b9cf7a2eb194210e071f4eb80aa1d6ee3cb2d"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: d2adecc6287dd4d559fe6ce2ce7a7e31",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649539",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5667e583-23b4-4e42-84e7-4774950d210b",
|
|
"value": "9e0f81958a03b9a50be4c3b10971b80c6eefd78f"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649539",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5667e583-0974-4a75-8e37-4f00950d210b",
|
|
"value": "https://www.virustotal.com/file/e17bdf72b3c6c53a3ee77e3edc0b9cf7a2eb194210e071f4eb80aa1d6ee3cb2d/analysis/1347227934/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: 2d722592a4e3c8030410dccccb221ce4",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649540",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5667e584-520c-4a98-99c8-4f2b950d210b",
|
|
"value": "ab40d67f4ed686f8f7cf686fc9c8a6f9f8f2b6fd80e0bf8e129875e2e428f24e"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: 2d722592a4e3c8030410dccccb221ce4",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649540",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5667e584-8210-411c-aae7-4f3f950d210b",
|
|
"value": "e4da283e0a6744a5339cf7f7d6f6e11026a6d9e4"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649540",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5667e584-c494-4cbb-8bb8-428f950d210b",
|
|
"value": "https://www.virustotal.com/file/ab40d67f4ed686f8f7cf686fc9c8a6f9f8f2b6fd80e0bf8e129875e2e428f24e/analysis/1345738881/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: dd1101adc86fd282f5f183942cc2f3b7",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649541",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5667e585-5c5c-4337-9504-4fe4950d210b",
|
|
"value": "56ea4781ccefb7596e77fcb7a57fb703007f2fb9b94fe33a3cc5257ab7996d1c"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: dd1101adc86fd282f5f183942cc2f3b7",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649541",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5667e585-d7e0-43ac-a5f6-4bfa950d210b",
|
|
"value": "44e6fb6aa66fc40a4389eb287d90cfef9593738b"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649792",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5667e680-8cec-4889-98f7-edb5950d210b",
|
|
"value": "bit.ly/1wl3ye2"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649793",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e681-d538-418a-9a13-edb5950d210b",
|
|
"value": "blackboxmusic.co"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649793",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e681-be28-4961-9760-edb5950d210b",
|
|
"value": "confirmation-blackberry.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649793",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e681-7044-4b83-9732-edb5950d210b",
|
|
"value": "confirmation-facebook.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649794",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e682-9550-4fa5-b0d8-edb5950d210b",
|
|
"value": "confirmation-icloud.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649794",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e682-9908-41b8-9545-edb5950d210b",
|
|
"value": "confirmation-outlook.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649795",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e683-2b70-4b75-ad2c-edb5950d210b",
|
|
"value": "confirmation-twitter.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649795",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e683-2dac-46cc-b3a3-edb5950d210b",
|
|
"value": "confirmation-yahoo.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649795",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e683-eaa4-4922-8f96-edb5950d210b",
|
|
"value": "deyrep.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649796",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e684-6370-4800-9824-edb5950d210b",
|
|
"value": "ecuadorenvivo.co"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649796",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e684-8b98-4caa-b3ad-edb5950d210b",
|
|
"value": "focusecuador.tk"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649797",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5667e685-573c-4291-afd5-edb5950d210b",
|
|
"value": "inyurl.com/q4kaf68"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649797",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e685-05e0-4e09-b025-edb5950d210b",
|
|
"value": "justicia-desvinculados.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649798",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e686-6b74-4921-8c3c-edb5950d210b",
|
|
"value": "main-local-latam-soporte-widget.cu9.co"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649799",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e687-2364-49c6-b12a-edb5950d210b",
|
|
"value": "main-local-latam-widget-soporte.cu9.co"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649800",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e688-f720-4205-be66-edb5950d210b",
|
|
"value": "movimientoanticorreista.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649800",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e688-35f0-4bea-a2a4-edb5950d210b",
|
|
"value": "no-creo.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649801",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e689-1c74-457f-9003-edb5950d210b",
|
|
"value": "soporte-login-account-gmail.tk"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649801",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e689-d464-4524-ae77-edb5950d210b",
|
|
"value": "soporte-login-account-yahoo.tk"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649802",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e68a-c428-47b6-8e89-edb5950d210b",
|
|
"value": "soporte-main-local-latam-es.cu9.co"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649802",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5667e68a-bc2c-4922-9ead-edb5950d210b",
|
|
"value": "soporte-main-local-latam-us.cu9.co"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649803",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e68b-818c-47cd-be91-edb5950d210b",
|
|
"value": "support-login-validate-outlook.tk"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649804",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5667e68c-ca04-403c-b56a-edb5950d210b",
|
|
"value": "tinyurl.com/ol6qzec"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649805",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5667e68d-62e0-4ec9-a6e1-edb5950d210b",
|
|
"value": "tinyurl.com/pl843ws"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649805",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5667e68d-ba10-41c7-a602-edb5950d210b",
|
|
"value": "tinyurl.com/px28gsa"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649805",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5667e68d-2e38-4246-9aaf-edb5950d210b",
|
|
"value": "tinyurl.com/q3zdyk8"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649806",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5667e68e-29fc-4121-814c-edb5950d210b",
|
|
"value": "tinyurl.com/q4kaf68"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649806",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5667e68e-02b8-4922-a4ab-edb5950d210b",
|
|
"value": "tinyurl.com/qxzz6ky"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1449649807",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5667e68f-4968-46d1-a6fb-edb5950d210b",
|
|
"value": "update-outlook.info"
|
|
}
|
|
]
|
|
}
|
|
} |