209 lines
No EOL
6.1 KiB
JSON
209 lines
No EOL
6.1 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "0",
|
|
"date": "2016-09-07",
|
|
"extends_uuid": "",
|
|
"info": "Malspam 2016-09-07 (.js in .zip) - campaign: \"Agreement form\"",
|
|
"publish_timestamp": "1473239656",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1473239644",
|
|
"uuid": "57cfd99f-ad68-4ebf-802f-06cc950d210f",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": "0",
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#3b7500",
|
|
"local": "0",
|
|
"name": "circl:incident-classification=\"malware\"",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1473239641",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "57cfda59-c974-4666-8888-19f0950d210f",
|
|
"value": "216.244.68.195"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1473239641",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "57cfda59-c01c-4c58-8591-19f0950d210f",
|
|
"value": "51.255.227.230"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1473239642",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "57cfda5a-a660-41e1-804c-19f0950d210f",
|
|
"value": "bookinghotworld.ws"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1473239642",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "57cfda5a-dfe4-4034-886b-19f0950d210f",
|
|
"value": "canonsupervideo4k.ws"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1473239642",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "57cfda5a-75b0-4d91-a98b-19f0950d210f",
|
|
"value": "clubofmalw.ws"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1473239642",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "57cfda5a-24bc-49a6-ab65-19f0950d210f",
|
|
"value": "donttouchmybaseline.ws"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1473239642",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "57cfda5a-2240-4dcb-aa73-19f0950d210f",
|
|
"value": "http://bookinghotworld.ws/0rvzpg1s"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1473239643",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "57cfda5b-e4ac-4193-848b-19f0950d210f",
|
|
"value": "http://canonsupervideo4k.ws/afeb6"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1473239643",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "57cfda5b-bcd4-40d4-9c19-19f0950d210f",
|
|
"value": "http://clubofmalw.ws/dn3q4s"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1473239643",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "57cfda5b-8f3c-47a5-88a6-19f0950d210f",
|
|
"value": "http://donttouchmybaseline.ws/ecf2k1o"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1473239643",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "57cfda5b-2c3c-4ea7-acf6-19f0950d210f",
|
|
"value": "http://malwinstall.wang/fsdglygf"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1473239643",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "57cfda5b-5ee8-41de-b462-19f0950d210f",
|
|
"value": "http://tradesmartcoin.xyz/jq8z2kpk"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1473239643",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "57cfda5b-0688-4d00-9a20-19f0950d210f",
|
|
"value": "http://virmalw.name/ykd1bqt"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1473239644",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "57cfda5c-3c04-409d-a05d-19f0950d210f",
|
|
"value": "malwinstall.wang"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1473239644",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "57cfda5c-0f14-4705-9d3d-19f0950d210f",
|
|
"value": "tradesmartcoin.xyz"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1473239644",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "57cfda5c-6e88-4385-8c2c-19f0950d210f",
|
|
"value": "virmalw.name"
|
|
}
|
|
]
|
|
}
|
|
} |