583 lines
No EOL
17 KiB
JSON
583 lines
No EOL
17 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "0",
|
|
"date": "2016-06-29",
|
|
"extends_uuid": "",
|
|
"info": "Malspam 2016-06-29 (campaign subject: 'Financial report')",
|
|
"publish_timestamp": "1467278807",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1467214481",
|
|
"uuid": "5773b18a-9710-4337-ae4c-4014950d210f",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": "0",
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#3b7500",
|
|
"local": "0",
|
|
"name": "circl:incident-classification=\"malware\"",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200104",
|
|
"to_ids": false,
|
|
"type": "user-agent",
|
|
"uuid": "5773b269-7c34-4ff4-befa-4580950d210f",
|
|
"value": "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200165",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2a5-83e4-43cb-9e63-49ae950d210f",
|
|
"value": "115.146.42.43"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200165",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2a5-8ec4-4d4e-9caf-4e13950d210f",
|
|
"value": "118.82.125.171"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200166",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2a6-ae30-47a0-b7a6-4dc2950d210f",
|
|
"value": "121.119.174.26"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200166",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2a6-2578-4428-aed5-473e950d210f",
|
|
"value": "121.50.42.232"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200166",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2a6-b634-4687-96e3-46b5950d210f",
|
|
"value": "121.50.44.68"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200166",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2a6-e06c-4cde-b91d-4b3d950d210f",
|
|
"value": "162.210.101.102"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200166",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2a6-c5ec-42d3-879f-4980950d210f",
|
|
"value": "162.210.101.82"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200167",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2a7-3adc-4de4-8847-4b38950d210f",
|
|
"value": "178.248.213.33"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200167",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2a7-5ae8-4c9a-b19c-4345950d210f",
|
|
"value": "178.63.16.71"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200167",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2a7-bf78-4b2d-b477-454b950d210f",
|
|
"value": "185.21.40.248"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200167",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2a7-ee7c-4828-9eb0-4f1b950d210f",
|
|
"value": "199.166.6.15"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200167",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2a7-aec4-49f3-8bf6-4871950d210f",
|
|
"value": "205.236.147.30"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200168",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2a8-d050-4b1c-a5ef-4ebd950d210f",
|
|
"value": "208.71.106.37"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200168",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2a8-3a04-49c9-872c-4fe8950d210f",
|
|
"value": "210.196.205.19"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200168",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2a8-a3a0-4c0b-bfac-4675950d210f",
|
|
"value": "213.158.72.90"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200168",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2a8-26a8-4cc7-b855-4c87950d210f",
|
|
"value": "216.239.136.156"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200168",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2a8-61ac-4545-bbf2-40e2950d210f",
|
|
"value": "217.31.51.180"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200169",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2a9-83cc-42a7-a476-4c93950d210f",
|
|
"value": "46.19.218.30"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200169",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2a9-54a0-4b7e-a721-4e98950d210f",
|
|
"value": "46.235.47.93"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200169",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2a9-aee4-40d6-b5e1-43e8950d210f",
|
|
"value": "65.99.205.183"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200169",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2a9-5464-4a3d-b998-444d950d210f",
|
|
"value": "69.27.174.10"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200170",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2aa-e9f8-4f43-985c-41cc950d210f",
|
|
"value": "80.150.6.138"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200170",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2aa-c18c-476e-a96d-4960950d210f",
|
|
"value": "82.140.32.172"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200170",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2aa-5c8c-4e29-8d2f-4f54950d210f",
|
|
"value": "82.197.131.109"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200170",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2aa-635c-48af-baa0-42f2950d210f",
|
|
"value": "83.235.64.44"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200170",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2aa-cc4c-4e0a-86a8-41ab950d210f",
|
|
"value": "88.86.120.181"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200171",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2ab-e204-4374-95bd-41e4950d210f",
|
|
"value": "89.42.39.81"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200171",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2ab-da7c-44e7-b07b-4f0b950d210f",
|
|
"value": "94.127.185.134"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200171",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2ab-4d80-4ce3-8766-4d86950d210f",
|
|
"value": "94.231.103.17"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200171",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5773b2ab-b0d0-4e30-a7d7-44de950d210f",
|
|
"value": "95.170.90.21"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200172",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5773b2ac-66fc-42cb-bd82-4785950d210f",
|
|
"value": "arquipiedra.cl"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200172",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5773b2ac-1e74-49c0-b2ba-4511950d210f",
|
|
"value": "benelist.cz"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200173",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5773b2ad-1390-4d45-80af-4f4c950d210f",
|
|
"value": "buron.dk"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200173",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5773b2ad-94a8-4f84-83cd-4f8e950d210f",
|
|
"value": "centralbs.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200174",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5773b2ae-e1e4-4e20-9095-40c0950d210f",
|
|
"value": "centro-odontoiatrico-neuromuscolare.it"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200174",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5773b2ae-22ac-4177-a51d-4989950d210f",
|
|
"value": "deutsch-krone.privat.t-online.de"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200175",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5773b2af-1398-4ac0-9c28-4a4c950d210f",
|
|
"value": "dewaeletransportes.atspace.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200175",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5773b2af-2e7c-4b7c-9949-44c2950d210f",
|
|
"value": "dragoljub.50webs.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200176",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5773b2b0-caec-476a-a198-436c950d210f",
|
|
"value": "elipse.es"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200176",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5773b2b0-b85c-4705-9b3f-456a950d210f",
|
|
"value": "free.co.ca"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200177",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5773b2b1-08d0-47e8-bf70-4acd950d210f",
|
|
"value": "geiten.nl"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200177",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5773b2b1-95d8-4752-a962-43fd950d210f",
|
|
"value": "greatlakessawingsolutions.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200177",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5773b2b1-2aa0-47eb-968b-48d5950d210f",
|
|
"value": "http://115.146.42.43/5dtvzet"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200178",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5773b2b2-9f88-4066-a7db-475e950d210f",
|
|
"value": "http://210.196.205.19/~pvpip/ypznpez0"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200178",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5773b2b2-c308-4746-baf7-40a8950d210f",
|
|
"value": "http://65.99.205.183/~studiantec/w29xxnph"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200179",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5773b2b3-fd78-4e6e-8879-42cc950d210f",
|
|
"value": "http://82.140.32.172/~haukebensch/3l6zu4"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200179",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5773b2b3-fa4c-4242-bb16-4590950d210f",
|
|
"value": "http://83.235.64.44/~astr-pap/3h59w9s"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "download location",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467200180",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5773b2b4-1f74-4d8f-931d-494e950d210f",
|
|
"value": "http://arquipiedra.cl/6xp7a8k5"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467215870",
|
|
"to_ids": false,
|
|
"type": "email-subject",
|
|
"uuid": "5773effe-ad50-4658-8241-40f8950d210f",
|
|
"value": "Financial report"
|
|
}
|
|
]
|
|
}
|
|
} |