36 lines
5.0 KiB
CSV
36 lines
5.0 KiB
CSV
|
uuid,event_id,category,type,value,comment,to_ids,date
|
|||
|
|
007694f1-b73a-40a5-bcf5-dded27746669,8,Network activity,url,"http://aax.me/0b152","",0,20161108
|
|||
|
|
19e97c58-4992-4f0b-8f49-6a6378a289eb,8,Payload delivery,sha256,"4320204d577ef8b939115d16110e97ff04cb4f7d1e77ba5ce011d43f74abc7be","message_032456944343.docm",0,20161108
|
|||
|
|
280056b8-69aa-432c-9826-6d5b820eb44e,8,Payload delivery,email-src,"andrew.dwight389@outlook.com","The Case of the Fake Journalist",0,20161108
|
|||
|
|
35aa025c-2f62-4f9d-9fb7-391542226a7a,8,Network activity,domain,"optimizedimghosting.com","The document’s macro was identical to the one sent to Donaghy, except it reported back to, and downloaded Stage Two from a different URL",1,20161108
|
|||
|
|
3813bc78-21d9-40a2-b76e-61016eb71ccb,8,Network activity,domain,"adhostingcache.com","",1,20161108
|
|||
|
|
41c48554-6911-48eb-88a0-411dc4bd9047,8,Payload delivery,sha1,"1c3757006f972ca957d925accf8bbb3023550d1b","message_032456944343.docm",0,20161108
|
|||
|
|
45dbee97-3aa0-487d-bd73-a3c10a511403,8,Network activity,ip-dst,"95.215.44.37","IP linked to adhostingcache.com",0,20161108
|
|||
|
|
537df72e-b2b9-4016-b337-06930c42c455,8,Network activity,url,"http://goo.gl/60HAqJ","redirects to http://aax.me/0b152",0,20161108
|
|||
|
|
58224765-51f8-4d28-9040-49798e96ca05,8,Attribution,threat-actor,"Stealth Falcon","",0,20161108
|
|||
|
|
582247a8-11b4-4da0-9ca1-69fe8e96ca05,8,Payload delivery,domain,"aax.me","",1,20161108
|
|||
|
|
582247d0-d7a0-49c3-a6ae-69fe8e96ca05,8,Payload delivery,url,"http://aax.me/a6faa","Link sent in a phishing email",1,20161108
|
|||
|
|
582247f6-eeec-47b0-b6d8-69fe8e96ca05,8,Payload delivery,url,"https://cloud.openmailbox.org/index.php/s/ujDNWMmg8pdG3AL/authenticate","ownCloud15 instance",0,20161108
|
|||
|
|
5822492e-087c-4fa8-afe1-49798e96ca05,8,Network activity,domain,"simpleadbanners.com","Domains linked to adhostingcache.com",0,20161108
|
|||
|
|
5822492e-1d40-4098-a87b-49798e96ca05,8,Network activity,domain,"clickstatistic.com","Domains linked to adhostingcache.com",0,20161108
|
|||
|
|
5822492e-7490-4c3f-9a10-49798e96ca05,8,Network activity,domain,"bestairlinepricetags.com","Domains linked to adhostingcache.com",0,20161108
|
|||
|
|
5822492e-d888-418e-906d-49798e96ca05,8,Network activity,domain,"fasttravelclearance.com","Domains linked to adhostingcache.com",0,20161108
|
|||
|
|
5822494d-792c-4d8c-9be0-49798e96ca05,8,Network activity,domain,"airlineadverts.com","Domain linked to incapsulawebcache.com",0,20161108
|
|||
|
|
5822494d-7ab0-42bd-bd9d-49798e96ca05,8,Network activity,domain,"ministrynewschannel.com","Domain linked to incapsulawebcache.com",0,20161108
|
|||
|
|
5822494d-bf14-4b41-803a-49798e96ca05,8,Network activity,domain,"ministrynewsinfo.com","Domain linked to incapsulawebcache.com",0,20161108
|
|||
|
|
62fcd7b4-5d95-49bd-a9ff-3c2e1854839b,8,Network activity,url,"http://optimizedimghosting.com/wddf/hrrw/ggrr.txt","The document’s macro was identical to the one sent to Donaghy, except it reported back to, and downloaded Stage Two from a different URL",0,20161108
|
|||
|
|
6c1856f6-0068-4c83-8aba-9fd4bb4277a1,8,Payload delivery,url,"http://aax.me/d0dde","loaded a page containing a redirect to the website of Al Jazeera. Before completing the redirect, it invoked JavaScript to profile the target’s computer.",0,20161108
|
|||
|
|
707eed9b-bb2c-4951-af0d-060b4c860e89,8,External analysis,link,"https://citizenlab.org/2016/05/stealth-falcon/","",0,20161108
|
|||
|
|
70881ae4-3da1-409e-8bd3-7f508092a2c9,8,Payload delivery,sha256,"5a372b45285fe6f3df3ba277ee2de55d4a30fc8ef05de729cf464103632db40f","right2fight.docm (malicious document)",0,20161108
|
|||
|
|
7fd6e683-9615-4f4e-b901-03e7dbb81337,8,Network activity,url,"https://incapsulawebcache.com/cache/cache.nfo","",0,20161108
|
|||
|
|
8010c934-027b-40c5-ba1e-3efca8e52d5a,8,Network activity,domain,"incapsulawebcache.com","stage two server",1,20161108
|
|||
|
|
8682a3ad-80da-4732-bf5a-e675e27c56fe,8,Network activity,domain,"edgecacheimagehosting.com","stage two server",1,20161108
|
|||
|
|
9ca61973-d717-496a-a158-82d9b2e37965,8,Payload delivery,md5,"87e1df6f36b96b56186444e37e2a1ef5","message_032456944343.docm",0,20161108
|
|||
|
|
bc8e2ca7-cd3c-4205-9028-b8b106f12389,8,Payload delivery,email-src,"the_right_to_fight@openmailbox.org","Fake invitation",0,20161108
|
|||
|
|
cd191e4e-a5a1-4009-93b7-92cc6a3d6984,8,Payload delivery,sha1,"f25466e4820404c817eaf75818b7177891735886","right2fight.docm (malicious document)",0,20161108
|
|||
|
|
d9a62cda-db4c-4d70-858c-6bbaaa041e63,8,Network activity,domain,"adhostingcaches.com","registered on December 3rd",1,20161108
|
|||
|
|
decfcbf1-1331-4624-88b7-a88c94637dd0,8,Network activity,url,"http://adhostingcache.com/ehhe/eh4g4/adcache.txt","Gathered information is returned to and the server’s response is executed as a PowerShell command.",0,20161108
|
|||
|
|
e8f3b924-1221-4d08-8fef-f689529a7b6d,8,Network activity,url,"http://aax.me/redirect.js","to profile a user’s system, perhaps to gather intelligence about potentially exploitable vulnerabilities.",0,20161108
|
|||
|
|
f0215c0c-b708-43d8-873e-80a3e8e54cfa,8,Network activity,url,"https://edgecacheimagehosting.com/images/image.nfo","The Stage Two in this case reported back to",0,20161108
|
|||
|
|
f4f40c31-dd17-4dc6-baa3-6beb35c04c00,8,Payload delivery,md5,"80e8ef78b9e28015cde4205aaa65da97","right2fight.docm (malicious document)",0,20161108
|