78 lines
3.9 KiB
Plaintext
78 lines
3.9 KiB
Plaintext
|
<?xml version="1.0" encoding="utf-8"?>
|
||
|
|
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="581bac8e-b478-474a-a013-49798e96ca05" last-modified="2015-10-16T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
|
||
|
|
<short_description>Event #4</short_description>
|
||
|
|
<description>Targeted Malware Attacks against NGO Linked to Attacks on Burmese Government Websites</description>
|
||
|
|
<keywords />
|
||
|
|
<authored_by>citizenlab</authored_by>
|
||
|
|
<authored_date>2015-10-16T00:00:00</authored_date>
|
||
|
|
<links />
|
||
|
|
<definition>
|
||
|
|
<Indicator operator="OR" id="581bac8e-b478-474a-a013-49798e96ca05">
|
||
|
|
<IndicatorItem id="c4c147bdfddffec2eea6bf99661e69ee" condition="is">
|
||
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
||
|
|
<Content type="md5"></Content>
|
||
|
|
</IndicatorItem>
|
||
|
|
<IndicatorItem id="884d46c01c762ad6ddd2759fd921bf71" condition="is">
|
||
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
||
|
|
<Content type="md5"></Content>
|
||
|
|
</IndicatorItem>
|
||
|
|
<IndicatorItem id="56f0e67d981024ddcc215543698f44fb" condition="is">
|
||
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
||
|
|
<Content type="md5"></Content>
|
||
|
|
</IndicatorItem>
|
||
|
|
<IndicatorItem id="7e0081fba718fcd71753d3199a290f03" condition="is">
|
||
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
||
|
|
<Content type="md5"></Content>
|
||
|
|
</IndicatorItem>
|
||
|
|
<IndicatorItem id="5710d567d98a8f4a6682859ce3a35336" condition="is">
|
||
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
||
|
|
<Content type="md5"></Content>
|
||
|
|
</IndicatorItem>
|
||
|
|
<IndicatorItem id="cec071424d417a095221bf8992819388" condition="is">
|
||
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
||
|
|
<Content type="md5"></Content>
|
||
|
|
</IndicatorItem>
|
||
|
|
<IndicatorItem id="49ceba3347d39870f15f2ab0391af234" condition="is">
|
||
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
||
|
|
<Content type="md5"></Content>
|
||
|
|
</IndicatorItem>
|
||
|
|
<IndicatorItem id="usafbi.websecexp.com" condition="is">
|
||
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
||
|
|
<Content type="string"></Content>
|
||
|
|
</IndicatorItem>
|
||
|
|
<IndicatorItem id="usacia.websecexp.com" condition="is">
|
||
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
||
|
|
<Content type="string"></Content>
|
||
|
|
</IndicatorItem>
|
||
|
|
<IndicatorItem id="webhttps.websecexp.com" condition="is">
|
||
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
||
|
|
<Content type="string"></Content>
|
||
|
|
</IndicatorItem>
|
||
|
|
<IndicatorItem id="iyouthen.com" condition="is">
|
||
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
||
|
|
<Content type="string"></Content>
|
||
|
|
</IndicatorItem>
|
||
|
|
<IndicatorItem id="appeur.gnway.cc" condition="is">
|
||
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
||
|
|
<Content type="string"></Content>
|
||
|
|
</IndicatorItem>
|
||
|
|
<IndicatorItem id="t1.mailsecurityservice.com" condition="is">
|
||
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
||
|
|
<Content type="string"></Content>
|
||
|
|
</IndicatorItem>
|
||
|
|
<IndicatorItem id="t2.mailsecurityservice.com" condition="is">
|
||
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
||
|
|
<Content type="string"></Content>
|
||
|
|
</IndicatorItem>
|
||
|
|
<IndicatorItem id="198.44.190.85" condition="is">
|
||
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
||
|
|
<Content type="IP"></Content>
|
||
|
|
</IndicatorItem>
|
||
|
|
<IndicatorItem id="http://www.hjclub.info/bbs/uploadfiles/45/ca-bundle.exe" condition="is">
|
||
|
|
<Context document="UrlHistoryItem" search="UrlHistoryItem/URL" type="mir" />
|
||
|
|
<Content type="string"></Content>
|
||
|
|
</IndicatorItem>
|
||
|
|
</Indicator>
|
||
|
|
</definition>
|
||
|
|
</ioc>
|