878 lines
No EOL
29 KiB
JSON
878 lines
No EOL
29 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2019-04-22",
|
|
"extends_uuid": "",
|
|
"info": "OSINT - CARBANAK Week - Fire Eye",
|
|
"publish_timestamp": "1557314563",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1557308326",
|
|
"uuid": "5cd14624-0b24-4386-85f5-4e5e950d210f",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:malpedia=\"Carbanak\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Carbanak - G0008\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-enterprise-attack-malware=\"Carbanak - S0030\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-enterprise-attack-relationship=\"FIN7 uses Carbanak\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-intrusion-set=\"Carbanak - G0008\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-malware=\"Carbanak - S0030\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#12e400",
|
|
"local": "0",
|
|
"name": "misp-galaxy:threat-actor=\"Anunak\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"FIN7 - G0046\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-intrusion-set=\"FIN7\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:mitre-intrusion-set=\"FIN7 - G0046\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#00b3b3",
|
|
"local": "0",
|
|
"name": "ecsirt:intrusions=\"backdoor\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#00a9ce",
|
|
"local": "0",
|
|
"name": "veris:action:malware:variety=\"Backdoor\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#2c0037",
|
|
"local": "0",
|
|
"name": "ms-caro-malware:malware-type=\"Backdoor\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#001534",
|
|
"local": "0",
|
|
"name": "ms-caro-malware-full:malware-type=\"Backdoor\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#3a7300",
|
|
"local": "0",
|
|
"name": "circl:incident-classification=\"malware\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#00223b",
|
|
"local": "0",
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": "0",
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557218891",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5cd1464b-5c38-40b2-bab2-44a3950d210f",
|
|
"value": "https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-one-a-rare-occurrence.html"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557218891",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5cd1464b-f590-4342-96f5-4204950d210f",
|
|
"value": "https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-two-continuing-source-code-analysis.html"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557218891",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5cd1464b-6008-4101-a704-4016950d210f",
|
|
"value": "https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-three-behind-the-backdoor.html"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557218891",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5cd1464b-b6f8-4ea7-bf52-4cc2950d210f",
|
|
"value": "https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-four-desktop-video-player.html"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Status: Commented out - Threat Group Association: Earlier CARBANAK activity",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557236282",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5cd18a3a-c808-4674-8acc-41f8950d210f",
|
|
"value": "comixed.org"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Status: Commented out - Threat Group Association: Earlier CARBANAK activity",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557236282",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5cd18a3a-3210-4ab0-9d58-4e65950d210f",
|
|
"value": "194.146.180.40"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Status: Active",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557236282",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5cd18a3a-9b74-4426-838f-44e7950d210f",
|
|
"value": "aaaabbbbccccc.org"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Status: Commented out - Threat Group Association: FIN7",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557236282",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5cd18a3a-8f68-448a-83bf-40c8950d210f",
|
|
"value": "stats10-google.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Status: Commented out",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557236282",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5cd18a3a-6860-4dc8-a3f9-42c3950d210f",
|
|
"value": "85.25.84.223"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Status: Active",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557236282",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5cd18a3a-8a48-4dbf-886f-4ee9950d210f",
|
|
"value": "qwqreererwere.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Status: Commented out - Threat Group Association: Earlier CARBANAK activity",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557236282",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5cd18a3a-e23c-4ee0-b712-465d950d210f",
|
|
"value": "akamai-technologies.org"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Status: Compiled",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557236282",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5cd18a3a-78d4-45fd-b116-411e950d210f",
|
|
"value": "hhklhlkhkjhjkjk.org"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Status: Compiled - Threat Group Association: DNS infrastructure overlap with later FIN7 associated POWERSOURCE activity",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557236282",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5cd18a3a-f414-49d6-b595-44b3950d210f",
|
|
"value": "aaa.stage.4463714.news.meteonovosti.info"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557296520",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5cd27588-6cbc-4373-a9d7-4e5d950d210f",
|
|
"value": "CARBANAK is one of the most full-featured backdoors around. It was used to perpetrate millions of dollars in financial crimes, largely by the group we track as FIN7. In 2017, Tom Bennett and Barry Vengerik published Behind the CARBANAK Backdoor, which was the product of a deep and broad analysis of CARBANAK samples and FIN7 activity across several years. On the heels of that publication, our colleague Nick Carr uncovered a pair of RAR archives containing CARBANAK source code, builders, and other tools (both available in VirusTotal: kb3r1p and apwmie)."
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Attribute #4905579 enriched by dns.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557302578",
|
|
"to_ids": false,
|
|
"type": "ip-src",
|
|
"uuid": "5cd28d32-4770-466b-b8c6-4655e387cbd9",
|
|
"value": "107.181.155.151"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Attribute #4905586 enriched by dns.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1557302581",
|
|
"to_ids": false,
|
|
"type": "ip-src",
|
|
"uuid": "5cd28d35-7a48-4b05-b933-4fd2e387cbd9",
|
|
"value": "23.253.126.58"
|
|
}
|
|
],
|
|
"Object": [
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "ip-port",
|
|
"template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
|
|
"template_version": "8",
|
|
"timestamp": "1557219940",
|
|
"uuid": "5cd14a64-a478-4a1d-bcaa-4af8950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "hostname",
|
|
"timestamp": "1557219940",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5cd14a64-a93c-4312-9e8d-4210950d210f",
|
|
"value": "vds2.system-host.net"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1557219941",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5cd14a65-74d0-494d-aec6-4aac950d210f",
|
|
"value": "104.193.252.151"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "dst-port",
|
|
"timestamp": "1557219941",
|
|
"to_ids": false,
|
|
"type": "port",
|
|
"uuid": "5cd14a65-c57c-495d-9f2d-4795950d210f",
|
|
"value": "443"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "last-seen",
|
|
"timestamp": "1557219941",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "5cd14a65-3f80-42e0-bc4e-4597950d210f",
|
|
"value": "2019-04-26T14:49:12"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "ip-port",
|
|
"template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
|
|
"template_version": "8",
|
|
"timestamp": "1557221122",
|
|
"uuid": "5cd14f02-6a40-4948-8120-41b7950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "hostname",
|
|
"timestamp": "1557221122",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5cd14f02-d9c0-4b4d-8cea-435e950d210f",
|
|
"value": "customer.clientshostname.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1557221122",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5cd14f02-a570-4395-93ee-484f950d210f",
|
|
"value": "185.180.196.35"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "dst-port",
|
|
"timestamp": "1557221122",
|
|
"to_ids": false,
|
|
"type": "port",
|
|
"uuid": "5cd14f02-5394-49c2-bae9-45aa950d210f",
|
|
"value": "443"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "last-seen",
|
|
"timestamp": "1557221122",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "5cd14f02-5a2c-4701-83dd-4eae950d210f",
|
|
"value": "2019-04-24T07:44:30"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "ip-port",
|
|
"template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
|
|
"template_version": "8",
|
|
"timestamp": "1557221244",
|
|
"uuid": "5cd14f7c-ed6c-4396-a8b8-48e9950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1557221244",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5cd14f7c-cf3c-4933-a073-4c35950d210f",
|
|
"value": "213.227.155.8"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "dst-port",
|
|
"timestamp": "1557221244",
|
|
"to_ids": false,
|
|
"type": "port",
|
|
"uuid": "5cd14f7c-1c24-484a-9823-43e0950d210f",
|
|
"value": "443"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "last-seen",
|
|
"timestamp": "1557221244",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "5cd14f7c-174c-49d0-a336-4580950d210f",
|
|
"value": "2019-04-24T04:33:52"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "ip-port",
|
|
"template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
|
|
"template_version": "8",
|
|
"timestamp": "1557221320",
|
|
"uuid": "5cd14fc8-cc7c-46e2-8498-456e950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1557221320",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5cd14fc8-cb38-4fbb-8e71-490c950d210f",
|
|
"value": "94.156.133.69"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "dst-port",
|
|
"timestamp": "1557221320",
|
|
"to_ids": false,
|
|
"type": "port",
|
|
"uuid": "5cd14fc8-3884-4328-a6e7-4232950d210f",
|
|
"value": "443"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "last-seen",
|
|
"timestamp": "1557221320",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "5cd14fc8-6524-41a0-9457-4b68950d210f",
|
|
"value": "2018-11-15T10:27:07"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "ip-port",
|
|
"template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
|
|
"template_version": "8",
|
|
"timestamp": "1557222039",
|
|
"uuid": "5cd15297-7048-4712-9572-4258950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1557222039",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5cd15297-21a0-4998-b558-456c950d210f",
|
|
"value": "185.174.172.241"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "dst-port",
|
|
"timestamp": "1557222039",
|
|
"to_ids": false,
|
|
"type": "port",
|
|
"uuid": "5cd15297-db20-4d41-b7c7-40d5950d210f",
|
|
"value": "443"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "last-seen",
|
|
"timestamp": "1557222039",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "5cd15297-ef24-478c-8a1e-4e17950d210f",
|
|
"value": "2019-04-27T13:24:36"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "ip-port",
|
|
"template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
|
|
"template_version": "8",
|
|
"timestamp": "1557222113",
|
|
"uuid": "5cd152e1-b8a0-4bcf-9ea3-4ca4950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1557222113",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5cd152e1-821c-4bf4-8a92-43ca950d210f",
|
|
"value": "109.230.199.227"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "dst-port",
|
|
"timestamp": "1557222113",
|
|
"to_ids": false,
|
|
"type": "port",
|
|
"uuid": "5cd152e1-251c-468d-bdd9-401d950d210f",
|
|
"value": "443"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "last-seen",
|
|
"timestamp": "1557222113",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "5cd152e1-4388-47c6-8780-4026950d210f",
|
|
"value": "2019-04-27T13:24:36"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "Status: Commented out",
|
|
"deleted": false,
|
|
"description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "ip-port",
|
|
"template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
|
|
"template_version": "8",
|
|
"timestamp": "1557224775",
|
|
"uuid": "5cd15d47-ed54-49b9-aeaa-4471950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1557224775",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5cd15d47-c4b8-49fb-81d4-492a950d210f",
|
|
"value": "37.1.212.100"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "dst-port",
|
|
"timestamp": "1557224775",
|
|
"to_ids": false,
|
|
"type": "port",
|
|
"uuid": "5cd15d47-e980-4374-984d-4e05950d210f",
|
|
"value": "700"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "Status: Commented out - Threat Group Association: Earlier CARBANAK activity",
|
|
"deleted": false,
|
|
"description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "ip-port",
|
|
"template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
|
|
"template_version": "8",
|
|
"timestamp": "1557224810",
|
|
"uuid": "5cd15d6a-b964-4779-8f3a-43b5950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1557224810",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5cd15d6a-b770-4f9d-b29b-4d29950d210f",
|
|
"value": "188.138.98.105"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "dst-port",
|
|
"timestamp": "1557224811",
|
|
"to_ids": false,
|
|
"type": "port",
|
|
"uuid": "5cd15d6b-bfbc-4488-a71b-47b5950d210f",
|
|
"value": "710"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "Status: Commented out",
|
|
"deleted": false,
|
|
"description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "ip-port",
|
|
"template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
|
|
"template_version": "8",
|
|
"timestamp": "1557234557",
|
|
"uuid": "5cd1837d-0694-4391-8cb9-364f950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1557234558",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5cd1837e-199c-4f9b-8460-364f950d210f",
|
|
"value": "80.84.49.50"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "dst-port",
|
|
"timestamp": "1557234558",
|
|
"to_ids": false,
|
|
"type": "port",
|
|
"uuid": "5cd1837e-3e1c-4109-8e6c-364f950d210f",
|
|
"value": "443"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "Status: Commented out",
|
|
"deleted": false,
|
|
"description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "ip-port",
|
|
"template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
|
|
"template_version": "8",
|
|
"timestamp": "1557235492",
|
|
"uuid": "5cd18724-ce4c-410f-95db-b3d7950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1557235492",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5cd18724-0dd8-473b-bb5a-b3d7950d210f",
|
|
"value": "52.11.125.44"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "dst-port",
|
|
"timestamp": "1557235492",
|
|
"to_ids": false,
|
|
"type": "port",
|
|
"uuid": "5cd18724-1acc-4132-ac62-b3d7950d210f",
|
|
"value": "443"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "Status: Active",
|
|
"deleted": false,
|
|
"description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "ip-port",
|
|
"template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
|
|
"template_version": "8",
|
|
"timestamp": "1557235569",
|
|
"uuid": "5cd18771-bac0-47c3-9a8c-a966950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1557308323",
|
|
"to_ids": false,
|
|
"type": "ip-dst",
|
|
"uuid": "5cd18771-9f18-4005-a613-a966950d210f",
|
|
"value": "192.168.0.100"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "dst-port",
|
|
"timestamp": "1557235569",
|
|
"to_ids": false,
|
|
"type": "port",
|
|
"uuid": "5cd18771-ecd8-412a-a9de-a966950d210f",
|
|
"value": "700"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "Status: Compiled",
|
|
"deleted": false,
|
|
"description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "ip-port",
|
|
"template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
|
|
"template_version": "8",
|
|
"timestamp": "1557235637",
|
|
"uuid": "5cd187b5-1eb8-474a-ae22-a97c950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1557308326",
|
|
"to_ids": false,
|
|
"type": "ip-dst",
|
|
"uuid": "5cd187b5-d93c-4c9a-9658-a97c950d210f",
|
|
"value": "192.168.0.100"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "dst-port",
|
|
"timestamp": "1557235637",
|
|
"to_ids": false,
|
|
"type": "port",
|
|
"uuid": "5cd187b5-0bc4-4376-8f80-a97c950d210f",
|
|
"value": "700"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "Status: Active - Threat Group Association: Earlier CARBANAK activity",
|
|
"deleted": false,
|
|
"description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "ip-port",
|
|
"template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
|
|
"template_version": "8",
|
|
"timestamp": "1557236169",
|
|
"uuid": "5cd189c9-dd18-4b41-9ad4-b3d7950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1557236169",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5cd189c9-6e80-4c2c-8949-b3d7950d210f",
|
|
"value": "193.203.48.23"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "dst-port",
|
|
"timestamp": "1557236169",
|
|
"to_ids": false,
|
|
"type": "port",
|
|
"uuid": "5cd189c9-8d90-43dc-8664-b3d7950d210f",
|
|
"value": "800"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |