138 lines
14 KiB
CSV
138 lines
14 KiB
CSV
|
uuid,event_id,category,type,value,comment,to_ids,date
|
|||
|
|
035cef0c-ab5b-4870-8a2d-3fffb2002a86,12,Network activity,domain,"www.blackboxmusic.co","",1,20161104
|
|||
|
|
04da6270-0f60-44e0-a68c-bb6d0eb89d84,12,Artifacts dropped,md5,"695db7dd3b1daf89f2c56d59faecc088","CyberGate",1,20161108
|
|||
|
|
075b1d0f-b7b2-4571-bd0c-9a2ad1c98663,12,Artifacts dropped,md5,"93b630891db21a4a2350280a360c713d","CyberGate",1,20161108
|
|||
|
|
078ea337-c004-430a-87d7-982e517f81c4,12,Artifacts dropped,md5,"4a23a1d6779d199aaa582cf0a5868ad1","Adzok",1,20161108
|
|||
|
|
080d5bfb-0924-48a0-8b75-37104a301e1c,12,Network activity,ip-dst,"201.52.24.126","",1,20161104
|
|||
|
|
09e60b2e-a849-4dc3-9910-59cd78bc3f82,12,Artifacts dropped,md5,"5a8975873f52436377d8fb0b5ab0d87a","CyberGate",1,20161108
|
|||
|
|
0a4ead27-a700-45f4-bcd0-b469d002b231,12,Network activity,ip-dst,"189.100.148.188","",1,20161104
|
|||
|
|
0c0abe15-22aa-433f-9a15-0b8196c3a99a,12,Network activity,domain,"venezuela365.com","",1,20161104
|
|||
|
|
0e4cc2f6-8b32-489a-8f86-6279b96ff313,12,Network activity,url,"http://ecuadorenvivo.co/videos/el-meme-que-volvio-loco-a-correa.html","",1,20161104
|
|||
|
|
0fabddd8-3837-4d33-bb62-efc4edfe67a5,12,Network activity,domain,"supportgmai1.com","",1,20161104
|
|||
|
|
1013af0f-98ea-44cf-8c57-d5dfcc2a9398,12,Network activity,domain,"conhost.servehttp.com","",1,20161104
|
|||
|
|
102812f0-1515-475b-85c9-fe3b9f298322,12,Network activity,domain,"mail-account-update.com","",1,20161104
|
|||
|
|
11c2de46-6ded-4948-914e-a8acff9ff027,12,Artifacts dropped,md5,"ce6065346a918a813eeb58bbb0814a23","CyberGate",1,20161108
|
|||
|
|
1242c1d0-3d53-48f2-a30f-f6566a46b262,12,Artifacts dropped,md5,"efc0009d76a2057f86c5f00030378c72","AlienSpy",1,20161108
|
|||
|
|
17548c65-6dd6-473f-b79c-9ad3095fb9b2,12,Artifacts dropped,md5,"a73351623577f44a2b578fed1e78e37e","CyberGate",1,20161108
|
|||
|
|
19da57bf-1c40-4472-a9e1-696a56ff0d12,12,Network activity,domain,"update-outlook.info","",1,20161104
|
|||
|
|
1b9f7074-c66c-472d-8917-0592bd07202e,12,Network activity,domain,"verify-gmail-support-secure.tk","",1,20161104
|
|||
|
|
1c9844bb-53a7-4c6d-859a-864d802fb755,12,Network activity,ip-dst,"198.12.150.249","",1,20161104
|
|||
|
|
1d17b791-20fd-4a0b-b074-36282e6fe9b9,12,Network activity,domain,"support-java.com","",1,20161104
|
|||
|
|
1f129d35-b9b2-42b4-81f6-8903c25c7080,12,Network activity,domain,"taskmgr.serveftp.com","",1,20161108
|
|||
|
|
1fcd075d-0b8f-42d9-852d-31813ae49879,12,Network activity,domain,"chavistas24.com","",1,20161104
|
|||
|
|
2034aaac-cd1a-4f24-9c9e-a622763cc35a,12,Artifacts dropped,md5,"15ebe16cd9500de534d5bfd5eeceaf73","CyberGate",1,20161108
|
|||
|
|
22c32e7b-f0a5-4e57-8821-a080cb880cdb,12,Network activity,domain,"mesvr.com","",1,20161104
|
|||
|
|
2738530c-979b-43ef-a7a3-6e509d38d073,12,Artifacts dropped,regkey,"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msconfig","",1,20161104
|
|||
|
|
29d3b93f-a8c7-46f0-8aaa-d5b1d3a7efa6,12,Network activity,domain,"dllhost.servehttp.com","",1,20161104
|
|||
|
|
2b8e7578-2b1b-4ee4-b690-812825551490,12,Network activity,domain,"deyrep24.ddns.net","C2 server",1,20161108
|
|||
|
|
2bcfdd38-8a5d-4512-b575-9b06096bed81,12,Network activity,domain,"ns1.ukraine.com.ua","",1,20161104
|
|||
|
|
2cd0f135-c88d-4a89-8cd4-bbc6cd3efa0f,12,Artifacts dropped,md5,"01dec1b1d0760d5a1a562edcfeb478d1","CyberGate",1,20161108
|
|||
|
|
2de6d004-f85c-4967-9aaf-f6a2bd9f4349,12,Network activity,ip-dst,"46.246.89.246","",1,20161104
|
|||
|
|
32c1f9d8-b15a-4f28-a91d-1d781b28aaa0,12,Network activity,domain,"n1.login-office365.com","",1,20161104
|
|||
|
|
33a05e11-fe8c-47e0-b8a2-55b568df6adf,12,Network activity,domain,"focusecuador.tk","",1,20161104
|
|||
|
|
341b2a91-d835-4766-8a27-d0a04cf9af90,12,Artifacts dropped,md5,"a74ef893b1bf21c9df6d8e31285db981","CyberGate",1,20161108
|
|||
|
|
378b1659-18cc-484d-aa90-df1a36849693,12,Artifacts dropped,md5,"1e6d0b59d4fb7650453c207688385f3a","CyberGate",1,20161108
|
|||
|
|
395f1ba8-c107-4622-a845-f2a2e2660b64,12,Network activity,domain,"movimientoanticorreista.com","",1,20161104
|
|||
|
|
3a638a7b-6cc4-4cfe-940c-921fb417e79c,12,Artifacts dropped,md5,"c2237e9d415f542ce6e73adb260af123","Xtreme RAT",1,20161108
|
|||
|
|
3b6d91fc-6693-453e-b8d0-9a0955b12a9c,12,Network activity,url,"http://ecuadorenvivo.com/videos/el-meme-que-volvio-loco-a-correa.html","",1,20161104
|
|||
|
|
3cd6d0dd-13e7-40b1-adaf-957bedfc212b,12,Artifacts dropped,md5,"7b2cb5249d704cb1df8d4210e7c3d553","CyberGate",1,20161108
|
|||
|
|
438fd35d-28ff-4669-a2c6-d3606ad95501,12,Payload delivery,email-src,"enripintos123@outlook.es","",1,20161104
|
|||
|
|
440b7b2b-7d18-4a95-a95c-f4d80412535c,12,Artifacts dropped,md5,"e03be1849ad7cecba1e20923074cd22f","CyberGate",1,20161108
|
|||
|
|
475c2ee5-d819-4a55-bb4d-1d909905c039,12,Artifacts dropped,md5,"d2adecc6287dd4d559fe6ce2ce7a7e31","Cybergate",1,20161108
|
|||
|
|
491292ff-d9e0-481e-aed8-575ac817cff9,12,Network activity,domain,"asambleanacional-gob-ec.cu9.co","",1,20161104
|
|||
|
|
4982d975-2425-4c0e-8709-8ea8c3743372,12,Payload delivery,email-src,"no-responder@supportgmai1.com","",1,20161104
|
|||
|
|
4e2e0b4c-8e54-40bc-9432-152d34b9980b,12,Network activity,domain,"24.com","",0,20161104
|
|||
|
|
4e37e013-f1ce-4df9-ae83-f04eb6b18ba9,12,Network activity,domain,"taskmgr.redirectme.com","",1,20161104
|
|||
|
|
50dd1978-ed90-48a0-8fae-f841d7d26c0e,12,Network activity,domain,"cu9.co","",1,20161104
|
|||
|
|
521771b2-16c0-44e8-b1c6-0dedfe52a93f,12,Network activity,url,"http://pancaliente.info/los-negocios-secretos-de-leocenis-garcia-y-gonzalo-tirado","",1,20161104
|
|||
|
|
53063744-8009-4309-823f-44ac089a9f4d,12,Network activity,domain,"formmail.com","",1,20161104
|
|||
|
|
53d09cce-3d68-4a76-bddb-118176b5eda6,12,Artifacts dropped,md5,"2de51e74fd571319bbf763ec62781096","AlienSpy",1,20161108
|
|||
|
|
55ab0c50-6ba9-44f0-bbf5-e30f13396fba,12,Artifacts dropped,md5,"1e4265a0c37773c2372b97bb6630ae57","Adzok",1,20161108
|
|||
|
|
55bc7d1d-b8c1-404a-ba53-0e81f893bf4f,12,Payload delivery,email-src,"movimiento.anti.correista@gmail.com","",1,20161104
|
|||
|
|
568339a3-cddf-4539-8e40-f2d726a5341b,12,Network activity,domain,"ecuadorenvivo.com","",1,20161104
|
|||
|
|
56e407af-b034-469f-833e-4261d12f4e3f,12,Network activity,ip-dst,"179.208.187.216","",1,20161104
|
|||
|
|
576bf524-78bd-47b8-9ae0-54ecea1bb4af,12,Network activity,domain,"ns1.deyrep.com","",1,20161104
|
|||
|
|
581c127f-fca8-4148-9a35-497a8e96ca05,12,External analysis,link,"https://citizenlab.org/2015/12/packrat-report/","",0,20161108
|
|||
|
|
582243bb-0f34-4775-9d56-49798e96ca05,12,Payload type,text,"CyberGate","",0,20161108
|
|||
|
|
582243bb-28a4-4ba0-bb04-49798e96ca05,12,Payload type,text,"Adzok","",0,20161108
|
|||
|
|
582243bb-c8d8-4986-a6f6-49798e96ca05,12,Payload type,text,"Xtreme RAT","",0,20161108
|
|||
|
|
582243bb-f194-4e73-8e86-49798e96ca05,12,Payload type,text,"AlienSpy","",0,20161108
|
|||
|
|
5f6ed532-7034-4529-8f1f-eca4f3ead06a,12,Network activity,domain,"soporte-login-account-yahoo.tk","",1,20161104
|
|||
|
|
613fc81a-9472-402a-864f-ba796bd820f9,12,Network activity,domain,"n4.pancaliente.info","",1,20161104
|
|||
|
|
63f47613-ca7a-4a85-859b-55acf0440a1a,12,Network activity,ip-dst,"50.63.202.57","",1,20161104
|
|||
|
|
64c9eefd-aabd-47be-8a66-56a3f777fca0,12,Network activity,domain,"taskmgr.redirectme.net","",1,20161104
|
|||
|
|
65be605b-ce44-483a-9398-c9b6c1d2584f,12,Network activity,domain,"s1.mgoogle.us","",1,20161104
|
|||
|
|
665a391e-0346-477b-8062-0e093fba3333,12,Artifacts dropped,md5,"a09f100ddc7cf29f8a93a3d7a79c58b9","CyberGate",1,20161108
|
|||
|
|
668f1383-b9db-44fb-ab01-49537c77ad1e,12,Network activity,domain,"blackboxmusic.co","",1,20161104
|
|||
|
|
694b6503-2ef8-4da9-8adf-1eaf5b0393c8,12,Artifacts dropped,md5,"2d722592a4e3c8030410dccccb221ce4","CyberGate",1,20161108
|
|||
|
|
69d8d573-3f23-493b-97f4-8fa6b4cf9f1b,12,Artifacts dropped,md5,"2827450763b55c5e71fda3caaf8e75f9","Xtreme RAT",1,20161108
|
|||
|
|
6cb4f4a0-1cf6-4cf4-98c2-5b9b93ff9867,12,Artifacts dropped,md5,"8fb96dfab7e4c0acb1eb9f4e950ba4b9","AlienSpy",1,20161108
|
|||
|
|
74bc6c34-77bb-4328-9edc-75059585e539,12,Network activity,domain,"mgoogle.us","",1,20161104
|
|||
|
|
77cc5d54-a422-4f1b-ab2f-167cdfde8bef,12,Network activity,domain,"focusecuador.net","",1,20161104
|
|||
|
|
7908fe7c-4346-4810-9f79-3ad2a8b93fd6,12,Network activity,domain,"n2.login-office365.com","",1,20161104
|
|||
|
|
7a7a2e9e-8e1e-45c7-ba5d-c6d6ce59465a,12,Network activity,domain,"ns1.hostinger.ru","",1,20161104
|
|||
|
|
7a948702-dd5c-46da-93e6-37d7bc088693,12,Network activity,ip-dst,"190.20.180.181","",1,20161104
|
|||
|
|
7b018a95-eb5d-4226-a5ca-9e32f4b288e4,12,Network activity,domain,"deyrep.com","",1,20161104
|
|||
|
|
7ca51a3d-b093-497f-accf-00bca0964287,12,Network activity,domain,"ns2.deyrep.com","",1,20161104
|
|||
|
|
809f7cd8-5a6f-4e4e-baca-d148180828b7,12,Network activity,url,"http://mail.asambleanacional.gob.ec","",1,20161104
|
|||
|
|
8149df18-d5b8-4b8f-9ebf-48676f586058,12,Network activity,ip-dst,"193.105.134.27","",1,20161104
|
|||
|
|
823b71a4-5bcc-4c16-bd79-816b1b6e70d9,12,Network activity,domain,"justicia-desvinculados.com","",1,20161104
|
|||
|
|
83aa404a-cb12-407c-993c-1ff9b7fa1947,12,Network activity,domain,"ftp.server.com","",1,20161104
|
|||
|
|
83bc4a8a-fe39-48d7-b26c-f4e4bfe08cde,12,Network activity,domain,"lolinha.no-ip.org","",1,20161104
|
|||
|
|
85d91d34-8222-4b2e-b154-0b394ec75fe3,12,Artifacts dropped,md5,"3a61d64986ee6529cee271ab6754faa5","CyberGate",1,20161108
|
|||
|
|
887aba05-4662-4967-8d93-09cb8b3d7685,12,Network activity,domain,"n1.support-java.com","",1,20161104
|
|||
|
|
88a1c5b7-d445-49fc-aa75-7ee28b069510,12,Payload delivery,email-src,"focusedtior1@gmail.com","",1,20161104
|
|||
|
|
89db0f38-a183-45b8-9503-69828bf29412,12,Network activity,ip-dst,"192.169.243.65","IP address linked to deyrep24.ddns.net",1,20161108
|
|||
|
|
8ae2e6c9-806a-4a57-aa17-aed767339990,12,Artifacts dropped,md5,"d7f34168b1a7dd7cbd8e62a5ab1ebc0e","Xtreme RAT",1,20161108
|
|||
|
|
8d8d0ac6-1cbe-4d9c-9b3c-8b7dbd1a1ce4,12,Artifacts dropped,md5,"779a79c11f581b84e7c81f321fd8d743","CyberGate",1,20161108
|
|||
|
|
8ea723f1-5e6d-4984-80a1-c844988006d9,12,Network activity,url,"http://venezuela365.com/wp-content/uploads/2014/10/tirado-g-300×169.jpg","",1,20161104
|
|||
|
|
8eecda70-e625-413f-b7fc-8451d76f4765,12,Network activity,domain,"ec.cu9.co","",1,20161104
|
|||
|
|
8f38d4c7-dff5-484f-be90-3aaa3fba6753,12,Artifacts dropped,md5,"d2f151312f7dee2483ddcab9766b56db","AlienSpy",1,20161108
|
|||
|
|
9096fec9-6b26-4c94-a9a1-8bfe16caf1b5,12,Artifacts dropped,md5,"8e0f021dcbbfa586a1c6780e77ac0fb6","CyberGate",1,20161108
|
|||
|
|
93541388-7cc4-436a-bf73-1e1584776a59,12,Network activity,domain,"www.movimientoanticorreista.com","",1,20161104
|
|||
|
|
9e0ea90e-1dae-4fd3-9fe2-a95bf8ff29c7,12,Network activity,ip-dst,"190.210.180.181","",1,20161104
|
|||
|
|
9f3c0a52-cf4e-434c-852b-a93df8a857e1,12,Payload delivery,email-src,"claudiobonadio88@gmail.com","",1,20161108
|
|||
|
|
9fbc655c-1010-4057-8af4-d29425574e3e,12,Artifacts dropped,md5,"13d939b2412c6adbab3cc1b539166671","CyberGate",1,20161108
|
|||
|
|
a0787877-1f51-45a2-a268-99585abd3753,12,Network activity,domain,"android-flash.com","",1,20161104
|
|||
|
|
a179e1f8-66e4-4055-a762-ed5d9166afa2,12,Artifacts dropped,md5,"74613eae84347183b4ca61b912a4573f","AlienSpy",1,20161108
|
|||
|
|
a38d5330-38f4-4016-a6a5-82fefed9aacd,12,Network activity,domain,"wjwjwjwj.no-ip.org","",1,20161104
|
|||
|
|
a391d94a-2311-4420-a315-067f450915c2,12,Network activity,domain,"ftp.ftpserver.com","",1,20161104
|
|||
|
|
a723650f-2306-48f3-a588-e57822f92448,12,Artifacts dropped,regkey,"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\Policies","",1,20161104
|
|||
|
|
a8d6eb71-318f-4516-b319-5e50d6996770,12,Artifacts dropped,md5,"dd1101adc86fd282f5f183942cc2f3b7","CyberGate",1,20161108
|
|||
|
|
ab318121-5622-4ea7-aca3-59e972601644,12,Network activity,domain,"n3.pancaliente.info","",1,20161104
|
|||
|
|
abb6b95e-2364-4aad-b826-7c925b587d0a,12,Network activity,domain,"lavozmericana.info","",1,20161104
|
|||
|
|
abc292cf-5485-4189-8c0a-b18d830cc7f2,12,Network activity,domain,"pancaliente.info","",1,20161104
|
|||
|
|
ac5dde92-e97e-4b57-9305-5e439f9bbb40,12,Artifacts dropped,md5,"ea50bf8abcf9c0c40c4490dc15fb0a2a","CyberGate",1,20161108
|
|||
|
|
aea5a3f5-d174-47c1-81a0-c97a5a478e00,12,Network activity,domain,"n1.lavozamericana.info","",1,20161104
|
|||
|
|
b0bd3917-ba04-4d95-a5d3-928993f331a9,12,Artifacts dropped,md5,"a988235ad7d47acbeca5ccb4ea5a1ed5","CyberGate",1,20161108
|
|||
|
|
b0df1407-9653-4f07-8f2e-5cd7f1c1a212,12,Network activity,domain,"n1.update-outlook.info","",1,20161104
|
|||
|
|
b373771f-54f4-4559-8297-52779ee94c28,12,Network activity,domain,"soporte-login-account-gmail.tk","",1,20161104
|
|||
|
|
b5b19817-6112-4eeb-b3d1-666f92b33ee7,12,Network activity,domain,"no.response.delivery.es","",1,20161104
|
|||
|
|
b66ec73a-4faf-4873-bdd8-8fdde6207ca4,12,Network activity,domain,"ecuadorenvivo.co","",1,20161104
|
|||
|
|
b812855c-8fdc-41f2-8857-8966aa84ea89,12,Network activity,domain,"ruley.no-ip.org","",1,20161104
|
|||
|
|
bc40a9ee-df43-4ba3-ad9d-529dc845d04b,12,Network activity,domain,"s2.mgoogle.us","",1,20161104
|
|||
|
|
bd9e3887-abea-465a-9f42-4ca38ea31d17,12,Artifacts dropped,md5,"0ae0038ffe8cf5c3170734a71ff2213d","AlienSpy",1,20161108
|
|||
|
|
c00a3cd4-3530-4a3d-a0b2-4231aad495ad,12,Network activity,domain,"login-office365.com","",1,20161104
|
|||
|
|
c103e0dc-7fb4-4e6d-a3d1-d6dfadc90045,12,Artifacts dropped,md5,"08a3bb5b220eb1e0dc2ecccbbc6859f5","Adzok",1,20161108
|
|||
|
|
c67572b2-b7f4-4f32-9e4d-a8892079fec4,12,Network activity,domain,"wjwjwj.no-ip.org","",1,20161104
|
|||
|
|
c6f40987-2e22-495f-9fcf-ce681c67e901,12,Network activity,domain,"daynews.sytes.net","domain linked to deyrep24.ddns.net",1,20161108
|
|||
|
|
c7d3ba98-9951-45a1-864f-ad1c6c000aad,12,Artifacts dropped,regkey,"HKLM\SOFTWARE\Microsoft\Active","",1,20161104
|
|||
|
|
c891c678-1cf0-4842-bcec-fe93b9479a28,12,Network activity,ip-dst,"50.62.133.49","IP address linked to deyrep24.ddns.net",1,20161108
|
|||
|
|
cbdf99c3-ac02-49e1-bd44-aa95c5e2acac,12,Network activity,domain,"wjwj.no-ip.org","",1,20161104
|
|||
|
|
ced4acdc-8a7e-4766-b6c6-431b37b0e332,12,Payload delivery,email-src,"cfed.bonadio@gmail.com","Phishing source pretending to be Claudio Bonadio",1,20161108
|
|||
|
|
cf896608-add9-45a1-8a66-8a04096b70f1,12,Network activity,domain,"mail.asambleanacional.gob.ec","",1,20161104
|
|||
|
|
cfd9e067-855e-4c38-af7b-b1ec7b9c5e0f,12,Network activity,domain,"support-whatsapp.com","",1,20161104
|
|||
|
|
d036cf1a-59fb-4c11-9da9-cbf99f5733a7,12,Artifacts dropped,md5,"ed8d7ed45b64890b8901b735018318f3","CyberGate",1,20161108
|
|||
|
|
d605e928-93ec-4aec-897e-0de476fe3f0e,12,Network activity,domain,"s1.support","",1,20161104
|
|||
|
|
d736d788-19c3-47d3-85ba-6f1b8a3f0897,12,Network activity,ip-dst,"186.220.1.84","",1,20161104
|
|||
|
|
d79f9f17-548f-4712-afdf-a8dc5dc43be1,12,Network activity,domain,"taskmgr.servehttp.com","",1,20161104
|
|||
|
|
da13fa70-4007-4c44-b611-a890dd8b1f31,12,Artifacts dropped,md5,"ea7bcf58a4ccdecb0c64e56b9998a4ac","Adzok",1,20161108
|
|||
|
|
dad67427-90fd-429f-94cc-15aab9efefc7,12,Artifacts dropped,md5,"bc97437fec7e7e8634c2eabae3cc4832","CyberGate",1,20161108
|
|||
|
|
e4567864-ed20-4a52-8ebc-280bb84bc259,12,Payload delivery,email-src,"no.response.delivery.es@gmail.com","",1,20161104
|
|||
|
|
ec9d62d6-4906-45a7-a781-a4b3939e77bc,12,Network activity,domain,"gmail.com.msg07.xyz","",1,20161104
|
|||
|
|
f4ce5713-8486-4eff-be64-f04899ad0e63,12,Network activity,ip-dst,"186.220.11.67","",1,20161104
|
|||
|
|
f5818138-37c1-412a-8cf7-2d7bcb538367,12,Network activity,domain,"lavozamericana.info","",1,20161104
|
|||
|
|
f7508074-3443-4ceb-a1b6-08e87bc65b44,12,Network activity,domain,"support-login-validate-outlook.tk","",1,20161104
|
|||
|
|
f7dbcb2a-96c1-48d9-8bda-785348f8d91b,12,Artifacts dropped,md5,"6c34d4296126679d9c6a0bc2660dc453","CyberGate",1,20161108
|
|||
|
|
fd6b3ff2-e441-4bc1-ba2d-d3d9dd50ab24,12,Network activity,domain,"ns.update-outlook.info","",1,20161104
|