1376 lines
No EOL
41 KiB
JSON
1376 lines
No EOL
41 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2017-03-02",
|
|
"extends_uuid": "",
|
|
"info": "OSINT - Covert Channels and Poor Decisions: The Tale of DNSMessenger",
|
|
"publish_timestamp": "1488486486",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1488486293",
|
|
"uuid": "58b87da8-48a4-4d5a-aac4-6a4902de0b81",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": "0",
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "58b87db6-8774-454e-ab1a-2dd902de0b81",
|
|
"value": "http://blog.talosintelligence.com/2017/03/dnsmessenger.html",
|
|
"Tag": [
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": "0",
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#075200",
|
|
"local": "0",
|
|
"name": "admiralty-scale:source-reliability=\"b\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#00223b",
|
|
"local": "0",
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "58b87df0-5704-44fe-b7d4-6a4602de0b81",
|
|
"value": "The Domain Name System (DNS) is one of the most commonly used Internet application protocols on corporate networks. It is responsible for providing name resolution so that network resources can be accessed by name, rather than requiring users to memorize IP addresses. While many organizations implement strict egress filtering as it pertains to web traffic, firewall rules, etc. many have less stringent controls in place to protect against DNS based threats. Attackers have recognized this and commonly encapsulate different network protocols within DNS to evade security devices.\r\n\r\nTypically this use of DNS is related to the exfiltration of information. Talos recently analyzed an interesting malware sample that made use of DNS TXT record queries and responses to create a bidirectional Command and Control (C2) channel. This allows the attacker to use DNS communications to submit new commands to be run on infected machines and return the results of the command execution to the attacker. This is an extremely uncommon and evasive way of administering a RAT. The use of multiple stages of Powershell with various stages being completely fileless indicates an attacker who has taken significant measures to avoid detection.",
|
|
"Tag": [
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": "0",
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#075200",
|
|
"local": "0",
|
|
"name": "admiralty-scale:source-reliability=\"b\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#00223b",
|
|
"local": "0",
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e78-26c4-4fa2-a480-8f4002de0b81",
|
|
"value": "algew.me"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e79-0958-4a3f-968e-8f4002de0b81",
|
|
"value": "aloqd.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e79-24f4-4105-b0a4-8f4002de0b81",
|
|
"value": "bpee.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e7a-a9f0-4a9a-9f4d-8f4002de0b81",
|
|
"value": "bvyv.club"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e7b-5108-48c3-b27f-8f4002de0b81",
|
|
"value": "bwuk.club"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e7c-0ef0-46b1-940c-8f4002de0b81",
|
|
"value": "cgqy.us"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e7d-ee4c-4054-81c5-8f4002de0b81",
|
|
"value": "cihr.site"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e7d-08c8-4a2d-96cc-8f4002de0b81",
|
|
"value": "ckwl.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e7e-73f4-4cff-b172-8f4002de0b81",
|
|
"value": "cnmah.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e7f-a214-44a6-aae4-8f4002de0b81",
|
|
"value": "coec.club"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e80-3d70-4f37-a57d-8f4002de0b81",
|
|
"value": "cuuo.us"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e81-5be8-46fc-99e2-8f4002de0b81",
|
|
"value": "daskd.me"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e81-de60-44f5-85e5-8f4002de0b81",
|
|
"value": "dbxa.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e82-c338-48bd-b4a7-8f4002de0b81",
|
|
"value": "dlex.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e83-e494-46c4-bf87-8f4002de0b81",
|
|
"value": "doof.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e84-2964-4fe4-8d8a-8f4002de0b81",
|
|
"value": "dtxf.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e84-7590-45f7-8a16-8f4002de0b81",
|
|
"value": "dvso.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e85-23e8-401c-97b1-8f4002de0b81",
|
|
"value": "dyiud.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e86-4410-4101-b9e8-8f4002de0b81",
|
|
"value": "eady.club"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e87-4ddc-4d91-b1ae-8f4002de0b81",
|
|
"value": "enuv.club"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e88-b9b0-4965-ab9d-8f4002de0b81",
|
|
"value": "eter.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e89-1588-449c-b7a8-8f4002de0b81",
|
|
"value": "fbjz.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e8a-21f0-4663-b163-8f4002de0b81",
|
|
"value": "fhyi.club"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e8a-0674-4903-bb8c-8f4002de0b81",
|
|
"value": "futh.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e8b-b7e0-400d-a030-8f4002de0b81",
|
|
"value": "gjcu.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e8c-67a4-4b8e-b84c-8f4002de0b81",
|
|
"value": "gjuc.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e8d-35e8-4980-b3f3-8f4002de0b81",
|
|
"value": "gnoa.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e8e-9db8-4954-8f57-8f4002de0b81",
|
|
"value": "grij.us"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e8f-2cb0-480f-9869-8f4002de0b81",
|
|
"value": "gxhp.top"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e8f-861c-43b8-ad24-8f4002de0b81",
|
|
"value": "hvzr.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e90-3cdc-417c-b4e5-8f4002de0b81",
|
|
"value": "idjb.us"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e91-a690-4963-a30b-8f4002de0b81",
|
|
"value": "ihrs.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e92-25b4-47cd-8982-8f4002de0b81",
|
|
"value": "jimw.club"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e93-86ac-47b7-9dd4-8f4002de0b81",
|
|
"value": "jomp.site"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e93-97fc-464a-9bbf-8f4002de0b81",
|
|
"value": "jxhv.site"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e94-58f8-493e-a144-8f4002de0b81",
|
|
"value": "kjke.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e95-f168-48e2-b43b-8f4002de0b81",
|
|
"value": "kshv.site"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e96-5248-4011-a7c8-8f4002de0b81",
|
|
"value": "kwoe.us"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e97-3d70-4e71-92b7-8f4002de0b81",
|
|
"value": "ldzp.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e97-aeec-4ffe-83eb-8f4002de0b81",
|
|
"value": "lhlv.club"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e98-68a0-4b0b-b491-8f4002de0b81",
|
|
"value": "lnoy.site"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e99-fba8-4faa-b4d0-8f4002de0b81",
|
|
"value": "lvrm.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e9a-c284-456c-aa81-8f4002de0b81",
|
|
"value": "lvxf.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e9b-cfa4-4fe2-b0e8-8f4002de0b81",
|
|
"value": "mewt.us"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e9b-877c-4cec-ae71-8f4002de0b81",
|
|
"value": "mfka.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e9c-38b0-4ca0-8d8f-8f4002de0b81",
|
|
"value": "mjet.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e9d-74a0-48a5-b2d6-8f4002de0b81",
|
|
"value": "mjut.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e9e-d600-4f19-a550-8f4002de0b81",
|
|
"value": "mvze.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e9e-61f0-4771-9821-8f4002de0b81",
|
|
"value": "mxfg.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87e9f-cb2c-4a1b-9bbe-8f4002de0b81",
|
|
"value": "nroq.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ea0-d238-46f9-80bb-8f4002de0b81",
|
|
"value": "nwrr.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ea1-6560-4f24-b0b8-8f4002de0b81",
|
|
"value": "nxpu.site"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ea2-4a08-41dd-9c2c-8f4002de0b81",
|
|
"value": "oaax.site"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ea2-0c50-471f-8b4d-8f4002de0b81",
|
|
"value": "odwf.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ea3-73a4-4c2f-a34b-8f4002de0b81",
|
|
"value": "odyr.us"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ea4-e380-4d3d-9277-8f4002de0b81",
|
|
"value": "okiq.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ea5-a9b0-45f8-8cda-8f4002de0b81",
|
|
"value": "oknz.club"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ea5-da44-4ac9-87a0-8f4002de0b81",
|
|
"value": "ooep.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ea6-a0d8-4a90-958f-8f4002de0b81",
|
|
"value": "ooyh.us"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ea7-b008-4bb4-80b4-8f4002de0b81",
|
|
"value": "otzd.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ea8-0db8-4112-857a-8f4002de0b81",
|
|
"value": "oxrp.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ea8-9980-4a6c-ace8-8f4002de0b81",
|
|
"value": "oyaw.club"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ea9-225c-4a77-992d-8f4002de0b81",
|
|
"value": "pafk.us"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87eaa-9944-4f95-aecf-8f4002de0b81",
|
|
"value": "palj.us"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87eab-9d14-48fe-b3f7-8f4002de0b81",
|
|
"value": "pbbk.us"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87eab-d524-4fca-a7a7-8f4002de0b81",
|
|
"value": "ppdx.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87eac-2c28-4ec3-9f3f-8f4002de0b81",
|
|
"value": "pvze.club"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ead-59f4-480d-87ca-8f4002de0b81",
|
|
"value": "qefg.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87eae-d0fc-4dbe-8a51-8f4002de0b81",
|
|
"value": "qlpa.club"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87eaf-3988-4424-a389-8f4002de0b81",
|
|
"value": "qznm.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87eaf-a818-4b93-b966-8f4002de0b81",
|
|
"value": "reld.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87eb0-0ebc-4bcc-a66e-8f4002de0b81",
|
|
"value": "rnkj.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87eb1-15ec-4357-bc6d-8f4002de0b81",
|
|
"value": "rzzc.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87eb2-c7a8-4cd1-ac01-8f4002de0b81",
|
|
"value": "sgvt.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87eb2-3610-42df-bbdd-8f4002de0b81",
|
|
"value": "soru.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87eb3-c584-4fe6-b141-8f4002de0b81",
|
|
"value": "swio.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87eb4-dfa4-4e06-85c6-8f4002de0b81",
|
|
"value": "tijm.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87eb5-1138-4f3c-8f7f-8f4002de0b81",
|
|
"value": "tsrs.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87eb6-950c-4a97-b42a-8f4002de0b81",
|
|
"value": "turp.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87eb6-4c24-4321-a77b-8f4002de0b81",
|
|
"value": "ueox.club"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87eb7-38cc-453c-832e-8f4002de0b81",
|
|
"value": "ufyb.club"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87eb8-b2c0-4214-8c65-8f4002de0b81",
|
|
"value": "utca.site"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87eb9-6d38-405d-b05d-8f4002de0b81",
|
|
"value": "vdfe.site"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87eb9-d8a8-4753-89a9-8f4002de0b81",
|
|
"value": "vjro.club"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87eba-8b4c-4608-a395-8f4002de0b81",
|
|
"value": "vkpo.us"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ebb-7b9c-4e79-a1b5-8f4002de0b81",
|
|
"value": "vpua.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ebc-5564-48af-9304-8f4002de0b81",
|
|
"value": "vqba.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ebc-4aec-4a49-a5a0-8f4002de0b81",
|
|
"value": "vwcq.us"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ebd-347c-4a05-9d2c-8f4002de0b81",
|
|
"value": "vxqt.us"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ebe-ce74-4024-a4eb-8f4002de0b81",
|
|
"value": "vxwy.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ebf-f4e8-4a83-9cd8-8f4002de0b81",
|
|
"value": "wfsv.us"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ec0-d6b0-42d4-9fbb-8f4002de0b81",
|
|
"value": "wqiy.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ec0-42a4-4aa0-b97d-8f4002de0b81",
|
|
"value": "wvzu.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ec1-1064-46cf-a8d5-8f4002de0b81",
|
|
"value": "xhqd.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ec2-5ed0-4a32-bd1e-8f4002de0b81",
|
|
"value": "yamd.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ec3-f038-4ef5-90b8-8f4002de0b81",
|
|
"value": "yedq.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ec3-d94c-4d9b-82f7-8f4002de0b81",
|
|
"value": "yqox.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ec4-382c-4a96-86cd-8f4002de0b81",
|
|
"value": "ysxy.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ec5-ff3c-4686-ba6e-8f4002de0b81",
|
|
"value": "zcnt.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ec6-bce8-4e91-a37b-8f4002de0b81",
|
|
"value": "zdqp.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ec6-71f4-4112-9c60-8f4002de0b81",
|
|
"value": "zjav.us"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ec7-61c4-4800-a823-8f4002de0b81",
|
|
"value": "zjvz.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ec8-aecc-4f47-b6c6-8f4002de0b81",
|
|
"value": "zmyo.club"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87ec9-eb9c-4d2b-ae64-8f4002de0b81",
|
|
"value": "zody.pw"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87eca-1754-4592-aa90-8f4002de0b81",
|
|
"value": "zugh.us"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 Domains:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58b87eca-23bc-41ce-ba8e-8f4002de0b81",
|
|
"value": "cspg.pw"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58b87eea-829c-4521-b0e5-40a602de0b81",
|
|
"value": "f9e54609f1f4136da71dbab8f57c2e68e84bcdc32a58cc12ad5f86334ac0eacf"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58b87eea-3e70-4b6e-b1db-4cca02de0b81",
|
|
"value": "f82baa39ba44d9b356eb5d904917ad36446083f29dced8c5b34454955da89174"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58b87eeb-7138-493f-bb6b-4deb02de0b81",
|
|
"value": "340795d1f2c2bdab1f2382188a7b5c838e0a79d3f059d2db9eb274b0205f6981"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58b87eec-29c8-4475-aecc-4fd602de0b81",
|
|
"value": "7f0a314f15a6f20ca6dced545fbc9ef8c1634f9ff8eb736deab73e46ae131458"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58b87eed-ba54-4625-a560-4c1602de0b81",
|
|
"value": "be5f4bfa35fc1b350d38d8ddc8e88d2dd357b84f254318b1f3b07160c3900750"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58b87eee-0408-450a-ab00-40fe02de0b81",
|
|
"value": "9b955d9d7f62d405da9cf05425c9b6dd3738ce09160c8a75d396a6de229d9dd7"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58b87eee-a180-45b6-bad1-464b02de0b81",
|
|
"value": "fd6e7fc11a325c498d73cf683ecbe90ddbf0e1ae1d540b811012bd6980eed882"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486293",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "58b87eef-411c-471f-9770-485f02de0b81",
|
|
"value": "6bf9d311ed16e059f9538b4c24c836cf421cf5c0c1f756fdfdeb9e1792ada8ba"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "- Xchecked via VT: 340795d1f2c2bdab1f2382188a7b5c838e0a79d3f059d2db9eb274b0205f6981",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486289",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "58b87f91-bc74-4999-b3c5-6a4902de0b81",
|
|
"value": "d00225d485c597bea712e7c7baa4fba7d7f281e3"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "- Xchecked via VT: 340795d1f2c2bdab1f2382188a7b5c838e0a79d3f059d2db9eb274b0205f6981",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486290",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "58b87f92-5c4c-45ca-85a5-6a4902de0b81",
|
|
"value": "2abad0ae32dd72bac5da0af1e580a2eb"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "- Xchecked via VT: 340795d1f2c2bdab1f2382188a7b5c838e0a79d3f059d2db9eb274b0205f6981",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1488486291",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "58b87f93-8fec-42ec-9055-6a4902de0b81",
|
|
"value": "https://www.virustotal.com/file/340795d1f2c2bdab1f2382188a7b5c838e0a79d3f059d2db9eb274b0205f6981/analysis/1488479981/"
|
|
}
|
|
]
|
|
}
|
|
} |