adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/5991e185-1808-4a0a-8df5-c44402de0b81.json

494 lines
No EOL
17 KiB
JSON
Raw Blame History

{
"Event": {
"analysis": "2",
"date": "2017-08-14",
"extends_uuid": "",
"info": "OSINT - The Blockbuster Saga Continues",
"publish_timestamp": "1502733046",
"published": true,
"threat_level_id": "3",
"timestamp": "1502733016",
"uuid": "5991e185-1808-4a0a-8df5-c44402de0b81",
"Orgc": {
"name": "CIRCL",
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
},
"Tag": [
{
"colour": "#ffffff",
"local": false,
"name": "tlp:white",
"relationship_type": ""
}
],
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": false,
"type": "link",
"uuid": "5991e193-efc8-41e2-ba11-457902de0b81",
"value": "https://researchcenter.paloaltonetworks.com/2017/08/unit42-blockbuster-saga-continues/",
"Tag": [
{
"colour": "#00223b",
"local": false,
"name": "osint:source-type=\"blog-post\"",
"relationship_type": ""
}
]
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": false,
"type": "text",
"uuid": "5991e1ac-9748-4213-8c8c-43a302de0b81",
"value": "Unit 42 researchers at Palo Alto Networks have discovered new attack activity targeting individuals involved with United States defense contractors. Through analysis of malicious code, files, and infrastructure it is clear the group behind this campaign is either directly responsible for or has cooperated with the group which conducted Operation Blockbuster Sequel and, ultimately, Operation Blockbuster (originally outlined by researchers from Novetta). The threat actors are reusing tools, techniques, and procedures which overlap throughout these operations with little variance. Attacks originating from this threat group have not ceased since our previous report (from April of 2017) and have continued through July of 2017.",
"Tag": [
{
"colour": "#00223b",
"local": false,
"name": "osint:source-type=\"blog-post\"",
"relationship_type": ""
}
]
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "url",
"uuid": "5991e1db-a100-4d93-8ea9-43e802de0b81",
"value": "http://210.202.40.35/CKRQST/event/careers/jobs/description/docs/NGC1398.doc"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "url",
"uuid": "5991e1db-a54c-4a1a-aa45-424f02de0b81",
"value": "http://210.202.40.35/CKRQST/Company/HR/Position/lm/L1915.doc"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "url",
"uuid": "5991e1db-2eb8-455e-96c6-4fc602de0b81",
"value": "http://104.192.193.149/Event/careers/jobs/description/docs/LJC077.doc"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "url",
"uuid": "5991e1db-39ac-4838-8009-476402de0b81",
"value": "http://lansingturbo.org/docs/WebDAV.exe"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "ip-dst",
"uuid": "5991e1e7-904c-4e34-8757-480b02de0b81",
"value": "104.192.193.149"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "ip-dst",
"uuid": "5991e1e7-2ee8-4650-b835-43e402de0b81",
"value": "176.35.250.93"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "ip-dst",
"uuid": "5991e1e7-cb88-40d2-a89f-470f02de0b81",
"value": "213.152.51.169"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "ip-dst",
"uuid": "5991e1e7-49b8-467e-b9b5-4b2602de0b81",
"value": "108.222.149.173"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "ip-dst",
"uuid": "5991e1e7-13d4-4131-a75f-4a3c02de0b81",
"value": "197.246.6.83"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "ip-dst",
"uuid": "5991e1e7-5600-4357-996d-428302de0b81",
"value": "118.140.97.6"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "ip-dst",
"uuid": "5991e1e7-2e88-4fc1-bee3-49d802de0b81",
"value": "210.202.40.35"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "ip-dst",
"uuid": "5991e1e7-bca0-4130-89e2-482402de0b81",
"value": "59.90.93.97"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "ip-dst",
"uuid": "5991e1e7-f7c4-4234-a9be-4ff302de0b81",
"value": "107.6.12.135"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "sha256",
"uuid": "5991e1fa-f61c-46df-bdbf-480d02de0b81",
"value": "4d4465bd9a57c7a3c0b80fa3282697554a1419794afa36e544a4ae06d60c1615"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "sha256",
"uuid": "5991e1fa-a230-4e68-bcf7-41fc02de0b81",
"value": "f390ef86a4ad92dde125c983e6470f08344b9eaa14c17a1e6c4bb7ebfa7c4ec9"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "sha256",
"uuid": "5991e1fa-62a4-4a41-8dac-427602de0b81",
"value": "acfae7e2fdda02e81b3e03f8c30741744d629cd672db424027f7caa59c975897"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "sha256",
"uuid": "5991e1fa-3940-4f00-9f46-4e0202de0b81",
"value": "7429a6b6e8518a1ec1d1c37a8786359885f2fd4abde560adaef331ca9deaeefd"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "sha256",
"uuid": "5991e1fa-d738-41b9-8ba2-4f9c02de0b81",
"value": "e09224a24a14a08c6fcb79b00b4a7b3097c84f805f5f2adefe2f7d04d7b4a8ee"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "sha256",
"uuid": "5991e1fa-e264-424e-83e6-4b8802de0b81",
"value": "062aadf3eb69686f4881860d88ce472e6b1c07e1f586d840dd2ee1f7b76cabe7"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "sha256",
"uuid": "5991e1fa-82b4-4493-8543-4ab102de0b81",
"value": "c63a415d23fc4ab10ad3acfdd47d42b5c7444604485ab45147277cca82fffb34"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "sha256",
"uuid": "5991e1fa-1c84-4131-a807-46a802de0b81",
"value": "16c3a7f143e831dd0481d2d57aae885090e22ec55cc8282009f641755d423fcd"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "sha256",
"uuid": "5991e1fa-9584-4430-b291-47b102de0b81",
"value": "de2d458c8e4befcd478a0010789d80997793790b18a347d10a595d6e87d91f34"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "sha256",
"uuid": "5991e1fa-1714-4972-8a39-476502de0b81",
"value": "2f133525f76ab0ebb0b370601673361253074c337f0b0895d0f0cb5bc261cfcb"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "sha256",
"uuid": "5991e1fa-9be8-43d4-8b9a-421f02de0b81",
"value": "e83a08bcb4353bfd6edcdedbc9ead9ab179a620e15155b60d18153bed9892f38"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "sha256",
"uuid": "5991e1fa-ba30-4d3c-b87f-496802de0b81",
"value": "6f673981892701d42159489c1b2614c098a04e4674b23e1cd0fd8911766e71a0"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "sha256",
"uuid": "5991e1fa-aa18-479c-a1f1-43af02de0b81",
"value": "ad075279d2ee6958105889d852e0d7f4266f746cb0078ac1b362f05a45b5828d"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "sha256",
"uuid": "5991e1fa-1bb0-4184-a3e4-48b102de0b81",
"value": "1288e105c83a6f4bbad8471a9b5bedafeea684a8d8b73a1a7518137d446c2e1e"
},
{
"category": "Payload delivery",
"comment": "- Xchecked via VT: 1288e105c83a6f4bbad8471a9b5bedafeea684a8d8b73a1a7518137d446c2e1e",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "sha1",
"uuid": "5991e2c3-aa68-4032-84fe-c43b02de0b81",
"value": "67d2eceea179d3e0e3b99a4464cca82bec2236dc"
},
{
"category": "Payload delivery",
"comment": "- Xchecked via VT: 1288e105c83a6f4bbad8471a9b5bedafeea684a8d8b73a1a7518137d446c2e1e",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "md5",
"uuid": "5991e2c3-8b14-48ef-aa08-c43b02de0b81",
"value": "307866c7d98fc9a050c0d178d95b3e8f"
},
{
"category": "External analysis",
"comment": "- Xchecked via VT: 1288e105c83a6f4bbad8471a9b5bedafeea684a8d8b73a1a7518137d446c2e1e",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": false,
"type": "link",
"uuid": "5991e2c3-8464-426c-b0da-c43b02de0b81",
"value": "https://www.virustotal.com/file/1288e105c83a6f4bbad8471a9b5bedafeea684a8d8b73a1a7518137d446c2e1e/analysis/1502714543/"
},
{
"category": "Payload delivery",
"comment": "- Xchecked via VT: 6f673981892701d42159489c1b2614c098a04e4674b23e1cd0fd8911766e71a0",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "sha1",
"uuid": "5991e2c3-ba9c-4d0f-8d37-c43b02de0b81",
"value": "cbb56d1aff6ddd7c280c52fd03ca10529b1b2e36"
},
{
"category": "Payload delivery",
"comment": "- Xchecked via VT: 6f673981892701d42159489c1b2614c098a04e4674b23e1cd0fd8911766e71a0",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "md5",
"uuid": "5991e2c3-66dc-42fa-9886-c43b02de0b81",
"value": "766ec87da598965efc2fb7e5a5b60ee2"
},
{
"category": "External analysis",
"comment": "- Xchecked via VT: 6f673981892701d42159489c1b2614c098a04e4674b23e1cd0fd8911766e71a0",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": false,
"type": "link",
"uuid": "5991e2c3-ae8c-46ce-acea-c43b02de0b81",
"value": "https://www.virustotal.com/file/6f673981892701d42159489c1b2614c098a04e4674b23e1cd0fd8911766e71a0/analysis/1502715759/"
},
{
"category": "Payload delivery",
"comment": "- Xchecked via VT: 16c3a7f143e831dd0481d2d57aae885090e22ec55cc8282009f641755d423fcd",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "sha1",
"uuid": "5991e2c3-381c-4078-82ea-c43b02de0b81",
"value": "9e2017128dd01108571b241f6c2b435d98d52d3c"
},
{
"category": "Payload delivery",
"comment": "- Xchecked via VT: 16c3a7f143e831dd0481d2d57aae885090e22ec55cc8282009f641755d423fcd",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "md5",
"uuid": "5991e2c3-44ec-4848-932a-c43b02de0b81",
"value": "e8aa28ad79c9adcf9bb8629973fdfa24"
},
{
"category": "External analysis",
"comment": "- Xchecked via VT: 16c3a7f143e831dd0481d2d57aae885090e22ec55cc8282009f641755d423fcd",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": false,
"type": "link",
"uuid": "5991e2c3-6d14-4f2d-97e4-c43b02de0b81",
"value": "https://www.virustotal.com/file/16c3a7f143e831dd0481d2d57aae885090e22ec55cc8282009f641755d423fcd/analysis/1502724035/"
},
{
"category": "Payload delivery",
"comment": "- Xchecked via VT: acfae7e2fdda02e81b3e03f8c30741744d629cd672db424027f7caa59c975897",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "sha1",
"uuid": "5991e2c3-86c8-45bb-8eb6-c43b02de0b81",
"value": "e784d38b6e628357d93e0db926590c8ef5393d1a"
},
{
"category": "Payload delivery",
"comment": "- Xchecked via VT: acfae7e2fdda02e81b3e03f8c30741744d629cd672db424027f7caa59c975897",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": true,
"type": "md5",
"uuid": "5991e2c3-c03c-4e9d-8e62-c43b02de0b81",
"value": "aa9548f3b03cc481c8c195fd458bc6dc"
},
{
"category": "External analysis",
"comment": "- Xchecked via VT: acfae7e2fdda02e81b3e03f8c30741744d629cd672db424027f7caa59c975897",
"deleted": false,
"disable_correlation": false,
"timestamp": "1502732995",
"to_ids": false,
"type": "link",
"uuid": "5991e2c3-ffac-4a61-9bd6-c43b02de0b81",
"value": "https://www.virustotal.com/file/acfae7e2fdda02e81b3e03f8c30741744d629cd672db424027f7caa59c975897/analysis/1502715852/"
}
]
}
}
Reference in a new issue View git blame Copy permalink