adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/59dc90da-d970-4168-901d-45c3950d210f.json

435 lines
No EOL
13 KiB
JSON
Raw Blame History

{
"Event": {
"analysis": "1",
"date": "2017-10-10",
"extends_uuid": "",
"info": "M2M - Locky 2017-10-10 : Affid=3, offline, \".asasin\" : \"Document ... is complete\" - \"invoice_1234_sign_and_return.7z\"",
"publish_timestamp": "1507832164",
"published": true,
"threat_level_id": "3",
"timestamp": "1507830375",
"uuid": "59dc90da-d970-4168-901d-45c3950d210f",
"Orgc": {
"name": "CIRCL",
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
},
"Tag": [
{
"colour": "#ffffff",
"local": "0",
"name": "tlp:white",
"relationship_type": ""
},
{
"colour": "#006c6c",
"local": "0",
"name": "ecsirt:malicious-code=\"ransomware\"",
"relationship_type": ""
},
{
"colour": "#0088cc",
"local": "0",
"name": "misp-galaxy:ransomware=\"Locky\"",
"relationship_type": ""
}
],
"Attribute": [
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": true,
"type": "md5",
"uuid": "59dc90db-2fe4-4682-86e1-48da950d210f",
"value": "11166f884550390d27c26a893506657a"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": true,
"type": "url",
"uuid": "59dc90dc-aa78-4949-83ec-4450950d210f",
"value": "http://agrourbis.com/iugftrs2"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": true,
"type": "hostname",
"uuid": "59dc90dc-92b8-448e-a3ff-4b3b950d210f",
"value": "agrourbis.com"
},
{
"category": "Network activity",
"comment": "agrourbis.com",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": false,
"type": "ip-dst",
"uuid": "59dc90dc-ecbc-48d6-b525-4cce950d210f",
"value": "86.109.170.66"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": true,
"type": "url",
"uuid": "59dc90dc-df80-4019-bcf5-4b4d950d210f",
"value": "http://axtes.com/iugftrs2"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": true,
"type": "hostname",
"uuid": "59dc90dc-2944-47d8-83e4-4be3950d210f",
"value": "axtes.com"
},
{
"category": "Network activity",
"comment": "axtes.com",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": false,
"type": "ip-dst",
"uuid": "59dc90dd-1b54-4cfc-af6d-41d6950d210f",
"value": "37.59.210.47"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": true,
"type": "url",
"uuid": "59dc90dd-a2c8-4b58-914a-4adc950d210f",
"value": "http://deltasec.net/iugftrs2"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": true,
"type": "hostname",
"uuid": "59dc90dd-d33c-40a1-87c0-46c5950d210f",
"value": "deltasec.net"
},
{
"category": "Network activity",
"comment": "deltasec.net",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": false,
"type": "ip-dst",
"uuid": "59dc90dd-8e7c-45df-8d8c-4817950d210f",
"value": "86.109.170.20"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": true,
"type": "url",
"uuid": "59dc90dd-1280-4139-a9e8-405e950d210f",
"value": "http://dueeffepromotion.com/iugftrs2"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": true,
"type": "hostname",
"uuid": "59dc90de-9c4c-49bd-ae20-4185950d210f",
"value": "dueeffepromotion.com"
},
{
"category": "Network activity",
"comment": "dueeffepromotion.com",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": false,
"type": "ip-dst",
"uuid": "59dc90de-2f14-4c3b-aef3-491c950d210f",
"value": "89.96.90.14"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": true,
"type": "url",
"uuid": "59dc90de-e3ac-4d89-968d-4bf5950d210f",
"value": "http://henweekendsbirmingham.co.uk/iugftrs2"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": true,
"type": "hostname",
"uuid": "59dc90de-0b84-4351-9ca3-47d2950d210f",
"value": "henweekendsbirmingham.co.uk"
},
{
"category": "Network activity",
"comment": "henweekendsbirmingham.co.uk",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": false,
"type": "ip-dst",
"uuid": "59dc90de-3168-40ca-8df6-4e1b950d210f",
"value": "91.192.195.226"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": true,
"type": "url",
"uuid": "59dc90df-40ec-46e5-b53a-4e8d950d210f",
"value": "http://likiihillschool.com/iugftrs2"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": true,
"type": "hostname",
"uuid": "59dc90df-e7a8-4d81-9af2-4256950d210f",
"value": "likiihillschool.com"
},
{
"category": "Network activity",
"comment": "likiihillschool.com",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": false,
"type": "ip-dst",
"uuid": "59dc90df-6634-4097-88a0-4d41950d210f",
"value": "41.207.64.13"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": true,
"type": "url",
"uuid": "59dc90e0-8d34-401a-913a-4e7e950d210f",
"value": "http://mastertenniscoach.com/iugftrs2"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": true,
"type": "hostname",
"uuid": "59dc90e0-5f70-4388-ac77-40ea950d210f",
"value": "mastertenniscoach.com"
},
{
"category": "Network activity",
"comment": "mastertenniscoach.com",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": false,
"type": "ip-dst",
"uuid": "59dc90e0-6f3c-4b5f-a982-48e7950d210f",
"value": "67.227.187.239"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": true,
"type": "url",
"uuid": "59dc90e1-12fc-4e14-9358-40d5950d210f",
"value": "http://shahanabiomedicals.com/iugftrs2"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": true,
"type": "hostname",
"uuid": "59dc90e1-c8e4-4648-a409-497d950d210f",
"value": "shahanabiomedicals.com"
},
{
"category": "Network activity",
"comment": "shahanabiomedicals.com",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": false,
"type": "ip-dst",
"uuid": "59dc90e1-2100-437a-9d7e-4902950d210f",
"value": "208.85.1.220"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": true,
"type": "url",
"uuid": "59dc90e1-3d7c-49e2-968c-44fc950d210f",
"value": "http://test.sisap.ro/iugftrs2"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": true,
"type": "hostname",
"uuid": "59dc90e2-60c8-4cb0-8fd8-4576950d210f",
"value": "test.sisap.ro"
},
{
"category": "Network activity",
"comment": "test.sisap.ro",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": false,
"type": "ip-dst",
"uuid": "59dc90e2-4428-4249-92ff-454e950d210f",
"value": "91.210.80.160"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": true,
"type": "url",
"uuid": "59dc90e2-7d20-4719-9f2d-4931950d210f",
"value": "http://xploramail.com/iugftrs2"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": true,
"type": "hostname",
"uuid": "59dc90e2-a4b0-4201-9f96-4c41950d210f",
"value": "xploramail.com"
},
{
"category": "Network activity",
"comment": "xploramail.com",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": false,
"type": "ip-dst",
"uuid": "59dc90e2-2964-4617-a9e0-4dc8950d210f",
"value": "185.57.172.213"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": true,
"type": "url",
"uuid": "59dc90e3-76a4-4769-ac76-49b8950d210f",
"value": "http://nsaflow.info/p66/iugftrs2"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": true,
"type": "hostname",
"uuid": "59dc90e3-6e68-48b2-91e8-4df0950d210f",
"value": "nsaflow.info"
},
{
"category": "Artifacts dropped",
"comment": "- Xchecked via VT: 11166f884550390d27c26a893506657a",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": true,
"type": "sha256",
"uuid": "59dfaa3c-a11c-4231-9212-4b4002de0b81",
"value": "3037b1b587eac2080d8c95d05cc5545f43128b2a69a08aa27e6058f7306b3c9b"
},
{
"category": "Artifacts dropped",
"comment": "- Xchecked via VT: 11166f884550390d27c26a893506657a",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": true,
"type": "sha1",
"uuid": "59dfaa3c-7d4c-44b6-bbf1-428302de0b81",
"value": "cf0c629de9a31e27b672e8898139123aed3bda0d"
},
{
"category": "External analysis",
"comment": "- Xchecked via VT: 11166f884550390d27c26a893506657a",
"deleted": false,
"disable_correlation": false,
"timestamp": "1507830332",
"to_ids": false,
"type": "link",
"uuid": "59dfaa3c-24e4-4934-982b-471e02de0b81",
"value": "https://www.virustotal.com/file/3037b1b587eac2080d8c95d05cc5545f43128b2a69a08aa27e6058f7306b3c9b/analysis/1507636989/"
}
]
}
}
Reference in a new issue View git blame Copy permalink