110 lines
5.8 KiB
Plaintext
110 lines
5.8 KiB
Plaintext
|
<?xml version="1.0" encoding="utf-8"?>
|
|||
|
|
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="5820aa49-6a40-4e51-86f9-497a8e96ca05" last-modified="2016-11-07T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
|
|||
|
|
<short_description>Event #17</short_description>
|
|||
|
|
<description>It’s Parliamentary: KeyBoy and the targeting of the Tibetan Community</description>
|
|||
|
|
<keywords />
|
|||
|
|
<authored_by>citizenlab</authored_by>
|
|||
|
|
<authored_date>2016-11-07T00:00:00</authored_date>
|
|||
|
|
<links />
|
|||
|
|
<definition>
|
|||
|
|
<Indicator operator="OR" id="5820aa49-6a40-4e51-86f9-497a8e96ca05">
|
|||
|
|
<IndicatorItem id="495adb1b9777002ecfe22aaf52fcee93" condition="is">
|
|||
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
|||
|
|
<Content type="md5"></Content>
|
|||
|
|
</IndicatorItem>
|
|||
|
|
<IndicatorItem id="0c7e55509e0b6d4277b3facf864af018" condition="is">
|
|||
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
|||
|
|
<Content type="md5"></Content>
|
|||
|
|
</IndicatorItem>
|
|||
|
|
<IndicatorItem id="98977426d544bd145979f65f0322ae30" condition="is">
|
|||
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
|||
|
|
<Content type="md5"></Content>
|
|||
|
|
</IndicatorItem>
|
|||
|
|
<IndicatorItem id="c5b5f01ba24d6c02636388809f44472e" condition="is">
|
|||
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
|||
|
|
<Content type="md5"></Content>
|
|||
|
|
</IndicatorItem>
|
|||
|
|
<IndicatorItem id="371bc132499f455f06fa80696db0df27" condition="is">
|
|||
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
|||
|
|
<Content type="md5"></Content>
|
|||
|
|
</IndicatorItem>
|
|||
|
|
<IndicatorItem id="087bffa8a570079948310dc9731c5709" condition="is">
|
|||
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
|||
|
|
<Content type="md5"></Content>
|
|||
|
|
</IndicatorItem>
|
|||
|
|
<IndicatorItem id="HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ver" condition="is">
|
|||
|
|
<Context document="Network" search="RegistryItem/KeyPath" type="mir" />
|
|||
|
|
<Content type="string"></Content>
|
|||
|
|
</IndicatorItem>
|
|||
|
|
<IndicatorItem id="9a55577d357922711ab0821bf5379289293c8517ae1d94d48c389f306af57a04" condition="is">
|
|||
|
|
<Context document="FileItem" search="FileItem/Sha256sum" type="mir" />
|
|||
|
|
<Content type="sha256"></Content>
|
|||
|
|
</IndicatorItem>
|
|||
|
|
<IndicatorItem id="5da2f14c382d7cac8dfa6c86e528a646a81f0b40cfee9611c8cfb4b5d589aa88" condition="is">
|
|||
|
|
<Context document="FileItem" search="FileItem/Sha256sum" type="mir" />
|
|||
|
|
<Content type="sha256"></Content>
|
|||
|
|
</IndicatorItem>
|
|||
|
|
<IndicatorItem id="tibetvoices.com" condition="is">
|
|||
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|||
|
|
<Content type="string"></Content>
|
|||
|
|
</IndicatorItem>
|
|||
|
|
<IndicatorItem id="www.about.jkub.com" condition="is">
|
|||
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|||
|
|
<Content type="string"></Content>
|
|||
|
|
</IndicatorItem>
|
|||
|
|
<IndicatorItem id="www.eleven.mypop3.org" condition="is">
|
|||
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|||
|
|
<Content type="string"></Content>
|
|||
|
|
</IndicatorItem>
|
|||
|
|
<IndicatorItem id="www.backus.myftp.name" condition="is">
|
|||
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|||
|
|
<Content type="string"></Content>
|
|||
|
|
</IndicatorItem>
|
|||
|
|
<IndicatorItem id="45.125.12.147" condition="is">
|
|||
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|||
|
|
<Content type="IP"></Content>
|
|||
|
|
</IndicatorItem>
|
|||
|
|
<IndicatorItem id="103.40.102.233" condition="is">
|
|||
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|||
|
|
<Content type="IP"></Content>
|
|||
|
|
</IndicatorItem>
|
|||
|
|
<IndicatorItem id="116.193.154.69" condition="is">
|
|||
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|||
|
|
<Content type="IP"></Content>
|
|||
|
|
</IndicatorItem>
|
|||
|
|
<IndicatorItem id="103.242.134.243" condition="is">
|
|||
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|||
|
|
<Content type="IP"></Content>
|
|||
|
|
</IndicatorItem>
|
|||
|
|
<IndicatorItem id="45.32.47.148" condition="is">
|
|||
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|||
|
|
<Content type="IP"></Content>
|
|||
|
|
</IndicatorItem>
|
|||
|
|
<IndicatorItem id="157.7.84.81" condition="is">
|
|||
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|||
|
|
<Content type="IP"></Content>
|
|||
|
|
</IndicatorItem>
|
|||
|
|
<IndicatorItem id="192.241.149.43" condition="is">
|
|||
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|||
|
|
<Content type="IP"></Content>
|
|||
|
|
</IndicatorItem>
|
|||
|
|
<IndicatorItem id="112.10.117.47" condition="is">
|
|||
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|||
|
|
<Content type="IP"></Content>
|
|||
|
|
</IndicatorItem>
|
|||
|
|
<IndicatorItem id="23d284245e53ae4fe05c517d807ffccf" condition="is">
|
|||
|
|
<Context document="FileItem" search="FileItem/Md5sum" type="mir" />
|
|||
|
|
<Content type="md5"></Content>
|
|||
|
|
</IndicatorItem>
|
|||
|
|
<IndicatorItem id="5f24a5ee9ecfd4a8e5f967ffcf24580a83942cd7b09d310b9525962ed2614a49" condition="is">
|
|||
|
|
<Context document="FileItem" search="FileItem/Sha256sum" type="mir" />
|
|||
|
|
<Content type="sha256"></Content>
|
|||
|
|
</IndicatorItem>
|
|||
|
|
<IndicatorItem id="542c85fda8df8510c1b66a122e459aac8c0919f1fe9fa2c43fd87899cffa05bf" condition="is">
|
|||
|
|
<Context document="FileItem" search="FileItem/Sha256sum" type="mir" />
|
|||
|
|
<Content type="sha256"></Content>
|
|||
|
|
</IndicatorItem>
|
|||
|
|
</Indicator>
|
|||
|
|
</definition>
|
|||
|
|
</ioc>
|