484 lines
No EOL
14 KiB
JSON
484 lines
No EOL
14 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2016-02-13",
|
|
"extends_uuid": "",
|
|
"info": "Additional IPs for Turla/Uroburos from CIRCL Passive SSL",
|
|
"publish_timestamp": "1498162463",
|
|
"published": true,
|
|
"threat_level_id": "1",
|
|
"timestamp": "1498162425",
|
|
"uuid": "56c18ccb-4c10-49ee-bf65-4b54950d210f",
|
|
"Orgc": {
|
|
"name": "CthulhuSPRL.be",
|
|
"uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#33FF00",
|
|
"local": "0",
|
|
"name": "tlp:green",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#12e200",
|
|
"local": "0",
|
|
"name": "misp-galaxy:threat-actor=\"Turla Group\"",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525130",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d0a-3044-4a60-851e-4aad950d210f",
|
|
"value": "209.239.79.29"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525130",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d0a-85b8-47d7-b18e-4571950d210f",
|
|
"value": "83.229.103.133"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525130",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d0a-8ebc-4383-8e80-4ffb950d210f",
|
|
"value": "169.255.100.222"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525131",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d0b-4234-4cdc-90d3-41f8950d210f",
|
|
"value": "78.138.25.29"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525131",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d0b-25ec-4494-b7ce-4d59950d210f",
|
|
"value": "82.146.174.240"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525131",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d0b-3198-4b66-9b4e-49cb950d210f",
|
|
"value": "83.229.62.179"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525132",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d0c-2774-40fe-94bd-4668950d210f",
|
|
"value": "193.220.55.6"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525132",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d0c-8cc8-4764-aa30-4e2c950d210f",
|
|
"value": "83.229.62.212"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525132",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d0c-8620-44a9-acce-4b0a950d210f",
|
|
"value": "169.255.100.152"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525133",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d0d-eec8-4f07-928c-41d5950d210f",
|
|
"value": "113.208.81.33"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525133",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d0d-ed24-4783-bcaf-48b1950d210f",
|
|
"value": "82.146.174.40"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525133",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d0d-8c50-4300-92b4-456c950d210f",
|
|
"value": "31.209.133.125"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525134",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d0e-5834-491e-b8bf-4caf950d210f",
|
|
"value": "82.146.175.52"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525134",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d0e-b86c-41cf-9917-47c2950d210f",
|
|
"value": "113.208.81.48"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525134",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d0e-8bcc-42a5-a11a-4801950d210f",
|
|
"value": "83.229.75.141"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525134",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d0e-d274-485d-b855-402b950d210f",
|
|
"value": "77.246.76.19"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525135",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d0f-4ffc-4160-8c0c-435d950d210f",
|
|
"value": "209.239.79.125"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525135",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d0f-2cf8-4a49-a84d-411a950d210f",
|
|
"value": "217.194.150.31"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525135",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d0f-39dc-4ea2-b99f-4460950d210f",
|
|
"value": "169.255.102.246"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525136",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d10-41f4-49eb-8644-44da950d210f",
|
|
"value": "169.255.101.235"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525136",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d10-b688-477c-93be-47a8950d210f",
|
|
"value": "82.146.166.58"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525136",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d10-9e50-4c2d-ace2-41d3950d210f",
|
|
"value": "217.194.149.111"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525136",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d10-bed4-40bb-800b-4f50950d210f",
|
|
"value": "169.255.102.110"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525137",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d11-2cbc-49fc-8277-432c950d210f",
|
|
"value": "169.255.100.122"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525137",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d11-cea8-4af3-bddc-4557950d210f",
|
|
"value": "169.255.101.65"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525137",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d11-d9a0-4c9e-ac83-40b7950d210f",
|
|
"value": "82.146.175.48"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525138",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d12-9a4c-4346-87db-46db950d210f",
|
|
"value": "113.208.81.55"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525138",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d12-25c8-4479-a395-488b950d210f",
|
|
"value": "82.146.166.61"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525138",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d12-d7f4-44b9-8b1a-4cf9950d210f",
|
|
"value": "217.8.36.239"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525138",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d12-6cd8-4eed-a84f-47cb950d210f",
|
|
"value": "83.229.62.210"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525139",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d13-c59c-4e66-8720-4ddc950d210f",
|
|
"value": "92.62.221.47"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525139",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d13-7228-4aa5-bf37-4a65950d210f",
|
|
"value": "82.146.175.69"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525139",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d13-4594-426f-bbae-4244950d210f",
|
|
"value": "82.146.175.29"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525139",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d13-f7ec-4b92-a29d-42ed950d210f",
|
|
"value": "83.229.62.249"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525140",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d14-99fc-41d8-8bf9-48dc950d210f",
|
|
"value": "41.203.79.74"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525140",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56c18d14-91e8-4402-9d1a-4013950d210f",
|
|
"value": "217.194.150.22"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525173",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "56c18d35-4654-4518-9bfa-468b950d210f",
|
|
"value": "https://twitter.com/circl_lu/status/698524566763806720"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455525173",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "56c18d35-bad0-4968-baf4-4da0950d210f",
|
|
"value": "http://pastebin.lu/oteminohod.cs"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455526580",
|
|
"to_ids": true,
|
|
"type": "x509-fingerprint-sha1",
|
|
"uuid": "56c192b4-cbf0-4bf1-9ac8-48e7950d210f",
|
|
"value": "f415844680ed9118ea74e0c7712b35044f0cc20d"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455526652",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "56c192fc-3ccc-48e7-b8c2-4b18950d210f",
|
|
"value": "Turla"
|
|
},
|
|
{
|
|
"category": "Attribution",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455526677",
|
|
"to_ids": false,
|
|
"type": "threat-actor",
|
|
"uuid": "56c19315-7a94-421a-8066-4523950d210f",
|
|
"value": "Turla"
|
|
}
|
|
]
|
|
}
|
|
} |